Repository navigation
Conversation
…otnet#135273) <!-- --> Resumed initial TLS handshakes now skip certificate revalidation and user validation callbacks by default (dotnet#133174). HttpClient tests that require those callbacks, certificate-policy checks, or certificate rejection can therefore fail or bypass their assertions after another connection populates the session cache. This follows the SslStream test-isolation approach in dotnet#135083. Add an optional `allowTlsResume = true` option to the existing handler helpers and request full handshakes only in validation-dependent tests. Preserve parameterless helper behavior, version-specific certificate defaults, and unrelated tests. The option reaches `SocketsHttpHandler.SslOptions.AllowTlsResume`; WinHTTP and native mobile handlers retain their native behavior because they do not expose this setting. Custom-policy tests set the option in their replacement SSL options rather than losing it when replacing the bag. Add coverage for default/true/false helper forwarding and repeated callback execution across fresh connections. The repeated test follows the existing .NET Framework loopback certificate-ownership convention. No product code or public API changes. ### Evidence and limitations With resumption enabled, the repeated self-signed test reproduced a failure on the second fresh connection: expected callback count 2, actual 1. With resumption disabled, all three callbacks execute. Sampled CI stacks also show callback-not-called and missing-certificate-rejection assertions. Separate badssl handshake resets and connection timeouts are not established resumption failures and are not claimed fixed here. HTTP/3 callback coverage passes, but QUIC does not currently consume `AllowTlsResume`; this is not a claimed QUIC-resumption fix. Validation was on Windows x64 only, with Release CoreCLR and Debug libraries. Other platforms and enterprise tests were not run. ### Validation All commands ran from a short `subst` path (`W:\`). - `.\build.cmd clr+libs -rc release`: passed, zero warnings/errors. Each project below was built and tested with `.\.dotnet\dotnet.exe build <project> /t:Test /p:RuntimeConfiguration=Release`: | Project | Result | |---|---| | `src\libraries\System.Net.Http\tests\FunctionalTests\System.Net.Http.Functional.Tests.csproj` | Passed: 5,435 passed, 48 skipped, zero failures | | `src\libraries\System.Net.Http\tests\UnitTests\System.Net.Http.Unit.Tests.csproj` | Passed: 2,677 passed, four skipped, zero failures | | `src\libraries\System.Net.Http.WinHttpHandler\tests\FunctionalTests\System.Net.Http.WinHttpHandler.Functional.Tests.csproj` | Passed: net11.0-windows 1,710 passed / 41 skipped; net481 640 passed / 28 skipped; zero failures | | `src\libraries\System.Net.Http.WinHttpHandler\tests\UnitTests\System.Net.Http.WinHttpHandler.Unit.Tests.csproj` | Passed: 173 passed, zero failures | External certificate and SSL-protocol coverage: ```powershell .\.dotnet\dotnet.exe build src\libraries\System.Net.Http\tests\FunctionalTests\System.Net.Http.Functional.Tests.csproj /t:Test /p:RuntimeConfiguration=Release /p:Outerloop=true "/p:XUnitOptions=-class System.Net.Http.Functional.Tests.SocketsHttpHandler_HttpClientHandler_ServerCertificates_Test -class System.Net.Http.Functional.Tests.SocketsHttpHandler_HttpClientHandler_SslProtocols_Test" ``` Passed: 53 passed, zero skipped/failures. Negative control, with `allowTlsResume` temporarily enabled in the repeated self-signed test: ```powershell .\.dotnet\dotnet.exe build src\libraries\System.Net.Http\tests\FunctionalTests\System.Net.Http.Functional.Tests.csproj /t:Test /p:RuntimeConfiguration=Release "/p:XUnitOptions=-method *UseCallback_SelfSignedCertificate_ExpectedPolicyErrors" ``` Expected failure: one passed, one failed due to the skipped second callback. Restored `allowTlsResume: false` before the final successful full-suite and outerloop runs. `git diff --check`: passed. > [!NOTE] > This PR description and code changes were generated with assistance from GitHub Copilot. --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> (cherry picked from commit a4802e5)
…35618) <!-- --> HTTP certificate validation tests currently depend on public badssl.com endpoints, making their results sensitive to external availability and certificate configuration. Replace the applicable cases with loopback servers and certificates generated by the existing test helpers. - Cover expired, self-signed, and wrong-host certificates with default validation, custom callbacks, and validation-disabled handlers. These cases now run in the inner loop. - Use scoped `X509ChainPolicy` custom trust to isolate SocketsHttpHandler validation errors, and the existing local PKI/revocation responder to exercise both revocation settings without installing trusted roots. - Dispose provisional TLS streams when loopback authentication fails, with a regression test for deterministic cleanup. The two external, no-callback WinHTTP revocation tests are intentionally retained. WinHttpHandler cannot use scoped custom trust, and callback-enabled replacements would test managed chain validation rather than native WinHTTP revocation enforcement. ## Validation Windows x64, using the `X:` subst path: - `build.cmd clr+libs -rc release`: passed. - Focused System.Net.Http certificate classes: 27 passed, none skipped. - Focused WinHTTP HTTP/1.1 and HTTP/2 certificate classes on `net11.0-windows`: 44 passed, none skipped. - Shared WinHTTP certificate tests on `net481`: 11 passed, none skipped. - Fourteen certificate/cleanup scenarios passed three consecutive reruns. - The cleanup regression failed before the helper fix and passed afterward. Linux, macOS, mobile, and the retained external WinHTTP revocation cases were not run. No product code or public API changes. > [!NOTE] > This pull request description was generated by GitHub Copilot. --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Miha Zupan <mihazupan.zupan1@gmail.com> Copilot-Session: 63463cf1-4bfe-42e3-ad96-49f35e245dd1 (cherry picked from commit f521600)
(cherry picked from commit 39ab468)
…or.IsSupported (dotnet#136119) `EncryptedXml_DecryptDocument_MaxCount_Default` (added in dotnet#135741) calls `RemoteExecutor.Invoke` from a plain `[Fact]`, so it throws `PlatformNotSupportedException` where RemoteExecutor isn't supported, e.g. the `runtime-coreclr crossgen2` outerloop R2R library runs ([build 1639697](https://dev.azure.com/dnceng-public/cbb18261-c48f-4abb-8651-8cdcb5474649/_build/results?buildId=1639697)). This changes it to `[ConditionalFact(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]`, matching its sibling `_AppContext` tests. > [!NOTE] > This PR was generated with the assistance of GitHub Copilot. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> (cherry picked from commit 677ab53)
|
Azure Pipelines: Successfully started running 4 pipeline(s). 11 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @karelz, @dotnet/ncl |
akoeplinger
approved these changes
Nov 11, 2026
Member
Author
|
/ba-g failures are known and tracked |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes Issue N/A (CI test failures on release/11.0, see Description)
main PR #135273, #135618, #135975, #136119
Description
Backports four test-only fixes from main. They are cherry-picked with
-xin this order and all applied cleanly:EncryptedXml_DecryptDocument_MaxCount_DefaultwithRemoteExecutor.IsSupportedThese tests fail in rolling (non-PR) CI on release/11.0 but don't fail on main. The failures come from Kusto
engsrvprod/engineeringdataAzureDevOpsTests, non-PR CI over the last 21 days:SocketsHttpHandler_HttpClientHandler_ServerCertificates_Test.UseCallback_BadCertificate_ExpectedPolicyErrors,...NoCallback_RevokedCertificate_NoRevocationChecking_Succeedsand the...DangerousAcceptAllCertificatesValidator...tests.Connection reset by peeragainst external*.badssl.comhosts. release/11.0Configuration.Http.csstill points at badssl.com.EncryptedXml_DecryptDocument_MaxCount_Default: fails on Android withPlatformNotSupportedException: RemoteExecutor is not supported(24 builds). Guard EncryptedXml_DecryptDocument_MaxCount_Default with RemoteExecutor.IsSupported #136119 makes the test conditional onRemoteExecutor.IsSupported.All 12 changed files are under
Common/testsor*/tests. Product code is unchanged.Customer Impact
None. Only tests change. Taking this removes recurring false failures from release/11.0 CI.
Regression
No. The failures are caused by external endpoints and platform test-infra limits, not product regressions.
Testing
git merge-treesimulation ontoorigin/release/11.0.git diff --name-only origin/release/11.0contains only test files.Risk
Very low. Only test code changes, and it already ships on main.
Package authoring no longer needed in .NET 9
IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.
Note
This PR description was generated with GitHub Copilot.