MacOS Certificate Generator Fix

azure-pipelines-arcade-PR.yml

@@ -210,7 +210,6 @@ stages:
       # Only build and test MacOS in PR and CI builds.
       - ${{ if eq(variables._RunAsPublic, True) }}:
         - job: MacOS
-          condition: ne(variables._RunWithCoreWcfService, True)
           timeoutInMinutes: 90
           pool:
             name: NetCore-Public

eng/SendToHelix.proj

@@ -83,6 +83,21 @@
     <HelixPreCommands>$(HelixPreCommands);export OPENSSL_ENABLE_SHA1_SIGNATURES=1</HelixPreCommands>
   </PropertyGroup>
 
+  <PropertyGroup Condition="'$(TestJob)' == 'MacOS'" >
+    <!-- Helix macOS workers run as the non-interactive 'helix-runner' user. The
+         existing login keychain (if any) has a password we do not know, which leaves
+         it locked and causes X509Store(My, CurrentUser).Open(ReadWrite) to fail with
+         errSecNoSuchKeychain / SecKeychainUnlock errors. Drop any pre-existing login
+         keychain and create a fresh one with an empty password so the test
+         infrastructure can install the client cert (dotnet/wcf#2870). -->
+    <HelixPreCommands>$(HelixPreCommands);security delete-keychain $HOME/Library/Keychains/login.keychain-db 2&gt;/dev/null || true</HelixPreCommands>
+    <HelixPreCommands>$(HelixPreCommands);security create-keychain -p "" $HOME/Library/Keychains/login.keychain-db</HelixPreCommands>
+    <HelixPreCommands>$(HelixPreCommands);security set-keychain-settings -lut 7200 $HOME/Library/Keychains/login.keychain-db</HelixPreCommands>
+    <HelixPreCommands>$(HelixPreCommands);security unlock-keychain -p "" $HOME/Library/Keychains/login.keychain-db</HelixPreCommands>
+    <HelixPreCommands>$(HelixPreCommands);security list-keychains -d user -s $HOME/Library/Keychains/login.keychain-db /Library/Keychains/System.keychain</HelixPreCommands>
+    <HelixPreCommands>$(HelixPreCommands);security default-keychain -d user -s $HOME/Library/Keychains/login.keychain-db</HelixPreCommands>
+  </PropertyGroup>
+
   <PropertyGroup Condition="'$(TestJob)' == 'Windows' AND '$(RunWithCoreWCFService)' == 'true'">
     <HelixPreCommands>$(HelixPreCommands);set PATH=%HELIX_CORRELATION_PAYLOAD%\dotnet-cli%3B%PATH%</HelixPreCommands>
     <!-- %3B is an escaped ; -->

src/System.Private.ServiceModel/tests/Common/Infrastructure/CertificateManager.cs

@@ -3,6 +3,7 @@
 // See the LICENSE file in the project root for more information.
 
 using System;
+using System.Diagnostics;
 using System.IO;
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
@@ -233,9 +234,97 @@ public static X509Certificate2 InstallCertificateToRootStore(X509Certificate2 ce
         {
             // See explanation of StoreLocation selection at PlatformSpecificRootStoreLocation
             certificate = AddToStoreIfNeeded(StoreName.Root, PlatformSpecificRootStoreLocation, certificate);
+
+            // On macOS, .NET's X509Store(Root, *) does not establish OS-level trust required by SslStream/SecTrust.
+            // Add an admin trust setting to the System.keychain via the `security` CLI. Passwordless sudo is set up
+            // for the Helix work item via eng/SendToHelix.proj pre-commands.
+            if ((OSHelper.Current & OSID.OSX) == OSHelper.Current)
+            {
+                AddTrustedRootOnMacOS(certificate);
+            }
+
             return certificate;
         }
 
+        private static void AddTrustedRootOnMacOS(X509Certificate2 certificate)
+        {
+            string pemPath = Path.Combine(Path.GetTempPath(), "wcf-root-" + certificate.Thumbprint + ".pem");
+            try
+            {
+                byte[] der = certificate.Export(X509ContentType.Cert);
+                var sb = new StringBuilder();
+                sb.AppendLine("-----BEGIN CERTIFICATE-----");
+                string b64 = Convert.ToBase64String(der);
+                for (int i = 0; i < b64.Length; i += 64)
+                {
+                    sb.AppendLine(b64.Substring(i, Math.Min(64, b64.Length - i)));
+                }
+                sb.AppendLine("-----END CERTIFICATE-----");
+                File.WriteAllText(pemPath, sb.ToString());
+
+                // add-trusted-cert -d writes to the admin trust domain via SecTrustSettings,
+                // which on headless macOS CI runners intermittently fails with
+                // "SecTrustSettingsSetTrustSettings: The authorization was denied since no user
+                // interaction was possible." The failure is transient, so retry a few times with
+                // a short backoff; without a trusted root every TLS test would fail with
+                // UntrustedRoot.
+                const int maxAttempts = 5;
+                for (int attempt = 1; attempt <= maxAttempts; attempt++)
+                {
+                    int rc = RunSecurity("sudo", "-n security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain \"" + pemPath + "\"");
+                    if (rc == 0)
+                    {
+                        break;
+                    }
+
+                    Console.WriteLine($"[CertificateManager] add-trusted-cert attempt {attempt}/{maxAttempts} failed (exit {rc})" + (attempt < maxAttempts ? "; retrying after 2s..." : "."));
+                    if (attempt < maxAttempts)
+                    {
+                        System.Threading.Thread.Sleep(2000);
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[CertificateManager] Failed to add macOS admin trust: " + ex);
+            }
+            finally
+            {
+                try { if (File.Exists(pemPath)) File.Delete(pemPath); } catch { }
+            }
+        }
+
+        private static int RunSecurity(string fileName, string arguments)
+        {
+            try
+            {
+                var psi = new ProcessStartInfo
+                {
+                    FileName = fileName,
+                    Arguments = arguments,
+                    RedirectStandardOutput = true,
+                    RedirectStandardError = true,
+                    UseShellExecute = false,
+                    CreateNoWindow = true,
+                };
+                using (var p = Process.Start(psi))
+                {
+                    string stdout = p.StandardOutput.ReadToEnd();
+                    string stderr = p.StandardError.ReadToEnd();
+                    p.WaitForExit(60000);
+                    Console.WriteLine($"[CertificateManager] {fileName} {arguments} exit={p.ExitCode}");
+                    if (!string.IsNullOrEmpty(stdout)) Console.WriteLine("[CertificateManager] stdout: " + stdout);
+                    if (!string.IsNullOrEmpty(stderr)) Console.WriteLine("[CertificateManager] stderr: " + stderr);
+                    return p.ExitCode;
+                }
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine($"[CertificateManager] Failed to run '{fileName} {arguments}': {ex}");
+                return -1;
+            }
+        }
+
         // Install the certificate into the My store.
         // It will not install the certificate if it is already present in the store.
         // It returns the thumbprint of the certificate, regardless whether it was added or found.

src/System.Private.ServiceModel/tests/Scenarios/Binding/UDS/UDSBindingTests.cs

@@ -93,7 +93,6 @@ public void WindowsAuth()
     }
 
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(SSL_Available))]
     [OuterLoop]
     private void BasicCertAsTransport()

src/System.Private.ServiceModel/tests/Scenarios/Binding/WS/FederationHttp/WSFederationHttpBindingTests.cs

@@ -14,7 +14,6 @@
 
 public class WSFederationHttpBindingTests : ConditionalWcfTest
 {
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
            nameof(Client_Certificate_Installed),
            nameof(SSL_Available),
@@ -76,7 +75,6 @@ public static void WSFederationHttpBindingTests_Succeeds(MessageSecurityVersion
         }
     }
 
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
        nameof(Client_Certificate_Installed),
        nameof(SSL_Available),
@@ -128,7 +126,6 @@ public static void WSTrustTokeParameters_WSStaticHelper()
         }
     }
 
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
         nameof(Client_Certificate_Installed),
         nameof(SSL_Available),

src/System.Private.ServiceModel/tests/Scenarios/Binding/WS/TransportWithMessageCredentialSecurity/BasicHttpTransportWithMessageCredentialSecurityTests.cs

@@ -8,7 +8,6 @@
 public class BasicHttpTransportWithMessageCredentialSecurityTests : ConditionalWcfTest
 {
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
                nameof(Client_Certificate_Installed),
                nameof(SSL_Available))]
@@ -56,7 +55,6 @@ public static void BasicHttps_SecModeTransWithMessCred_CertClientCredential_Succ
     }
 
     [WcfTheory]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
                nameof(SSL_Available))]
     [OuterLoop]
@@ -107,7 +105,6 @@ public static void BasicHttps_SecModeTransWithMessCred_UserNameClientCredential_
     }
 
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
                nameof(SSL_Available))]
     [OuterLoop]
@@ -156,7 +153,6 @@ public static void Https_SecModeTransWithMessCred_UserNameClientCredential_Succe
     }
 
     [WcfTheory]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
                nameof(SSL_Available))]
     [OuterLoop]

src/System.Private.ServiceModel/tests/Scenarios/Binding/WS/TransportWithMessageCredentialSecurity/BasicHttpsTransportWithMessageCredentialSecurityTests.cs

@@ -7,7 +7,6 @@
 public class BasicHttpsTransportWithMessageCredentialSecurityTests : ConditionalWcfTest
 {
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
                nameof(Client_Certificate_Installed),
                nameof(SSL_Available))]

src/System.Private.ServiceModel/tests/Scenarios/Binding/WS/TransportWithMessageCredentialSecurity/WS2007HttpTransportWithMessageCredentialsSecurityTests.cs

@@ -12,7 +12,6 @@
 public class WS2007HttpTransportWithMessageCredentialsSecurityTests : ConditionalWcfTest
 {
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
        nameof(Client_Certificate_Installed),
        nameof(SSL_Available))]

src/System.Private.ServiceModel/tests/Scenarios/Binding/WS/TransportWithMessageCredentialSecurity/WSHttpTransportWithMessageCredentialSecurityTests.cs

@@ -13,7 +13,6 @@
 public class WSHttpTransportWithMessageCredentialSecurityTests : ConditionalWcfTest
 {
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
            nameof(Client_Certificate_Installed),
            nameof(SSL_Available))]

src/System.Private.ServiceModel/tests/Scenarios/Binding/WS/TransportWithMessageCredentialSecurity/WSNetTcpTransportWithMessageCredentialSecurityTests.cs

@@ -15,7 +15,6 @@
 public class WSNetTcpTransportWithMessageCredentialSecurityTests : ConditionalWcfTest
 {
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
            nameof(Client_Certificate_Installed),
            nameof(SSL_Available))]
@@ -37,6 +36,15 @@ public static void NetTcp_SecModeTransWithMessCred_CertClientCredential_Succeeds
             clientCertThumb = ServiceUtilHelper.ClientCertificate.Thumbprint;
 
             factory = new ChannelFactory<IWcfService>(binding, endpointAddress);
+            // macOS SecTrust cannot obtain a positive revocation response for a
+            // private CA (dotnet/runtime#31249); the transport-cert revocation
+            // check is incidental to this message-credential scenario, so skip
+            // it on macOS only.
+            if (OSID.OSX.MatchesCurrent())
+            {
+                factory.Credentials.ServiceCertificate.Authentication.RevocationMode = X509RevocationMode.NoCheck;
+            }
+
             factory.Credentials.ClientCertificate.SetCertificate(
                 StoreLocation.CurrentUser,
                 StoreName.My,
@@ -63,7 +71,6 @@ public static void NetTcp_SecModeTransWithMessCred_CertClientCredential_Succeeds
     }
 
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
                nameof(SSL_Available))]
     [OuterLoop]
@@ -85,6 +92,15 @@ public static void NetTcp_SecModeTransWithMessCred_UserNameClientCredential_Succ
             endpointAddress = new EndpointAddress(new Uri(Endpoints.Tcp_SecModeTransWithMessCred_ClientCredTypeUserName));
 
             factory = new ChannelFactory<IWcfService>(binding, endpointAddress);
+            // macOS SecTrust cannot obtain a positive revocation response for a
+            // private CA (dotnet/runtime#31249); the transport-cert revocation
+            // check is incidental to this message-credential scenario, so skip
+            // it on macOS only.
+            if (OSID.OSX.MatchesCurrent())
+            {
+                factory.Credentials.ServiceCertificate.Authentication.RevocationMode = X509RevocationMode.NoCheck;
+            }
+
             username = Guid.NewGuid().ToString("n").Substring(0, 8);
             char[] usernameArr = username.ToCharArray();
             Array.Reverse(usernameArr);
@@ -112,7 +128,6 @@ public static void NetTcp_SecModeTransWithMessCred_UserNameClientCredential_Succ
     }
 
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
                nameof(SSL_Available))]
     [OuterLoop]

src/System.Private.ServiceModel/tests/Scenarios/Security/TransportSecurity/Https/HttpsTests.4.1.0.cs

@@ -18,7 +18,6 @@ public partial class HttpsTests : ConditionalWcfTest
     [WcfTheory]
     [InlineData(WSMessageEncoding.Text)]
     [InlineData(WSMessageEncoding.Mtom)]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
            nameof(Client_Certificate_Installed),
            nameof(Server_Accepts_Certificates),
@@ -221,7 +220,6 @@ public static void SameBinding_Soap12_EchoString()
     }
 
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
                nameof(Client_Certificate_Installed),
                nameof(SSL_Available))]
@@ -269,7 +267,6 @@ public static void ServerCertificateValidation_EchoString()
     }
 
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(SSL_Available))]
     [OuterLoop]
     public static async Task ServerCertificateValidationUsingIdentity_EchoString()
@@ -310,7 +307,6 @@ public static async Task ServerCertificateValidationUsingIdentity_EchoString()
     }
 
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Client_Certificate_Installed),
                nameof(SSL_Available))]
     [OuterLoop]
@@ -348,7 +344,6 @@ public static void ServerCertificateValidationUsingIdentity_Throws_EchoString()
     }
 
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
                nameof(Client_Certificate_Installed),
                nameof(Server_Accepts_Certificates),
@@ -398,7 +393,6 @@ public static void ClientCertificate_EchoString()
     }
 
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
            nameof(Client_Certificate_Installed),
            nameof(Server_Accepts_Certificates),

src/System.Private.ServiceModel/tests/Scenarios/Security/TransportSecurity/Https/HttpsTests.4.1.1.cs

@@ -4,6 +4,7 @@
 
 
 using System;
+using System.Security.Cryptography.X509Certificates;
 using System.ServiceModel;
 using System.ServiceModel.Security;
 using Infrastructure.Common;
@@ -171,6 +172,11 @@ public static void Https_SecModeTrans_CertValMode_PeerOrChainTrust_Succeeds_Chai
     }
 
     [WcfFact]
+    // macOS SecTrust cannot obtain a positive revocation response for a private
+    // CA under X509RevocationMode.Online (dotnet/runtime#31249), so a ChainTrust
+    // validation of the server cert fails on macOS. This test's purpose is the
+    // ChainTrust validation itself, so it is skipped on macOS rather than having
+    // its revocation check disabled.
     [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed),
                nameof(Client_Certificate_Installed),

src/System.Private.ServiceModel/tests/Scenarios/Security/TransportSecurity/Tcp/ClientCredentialTypeTests.4.1.0.cs

@@ -13,7 +13,6 @@
 public partial class Tcp_ClientCredentialTypeTests : ConditionalWcfTest
 {
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed), nameof(Client_Certificate_Installed))]
     [OuterLoop]
     public static void TcpClientCredentialType_Certificate_EchoString()
@@ -62,7 +61,6 @@ public static void TcpClientCredentialType_Certificate_EchoString()
     }
 
     [WcfFact]
-    [Issue(2870, OS = OSID.OSX)]
     [Condition(nameof(Root_Certificate_Installed), nameof(Client_Certificate_Installed))]
     [OuterLoop]
     public static void TcpClientCredentialType_Certificate_CustomValidator_EchoString()

src/System.Private.ServiceModel/tools/CertificateGenerator/CertificateGenerator/CertificateGenerator.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net471</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <OutputType>Exe</OutputType>
   </PropertyGroup>
 
@@ -10,7 +10,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <Reference Include="System.Configuration" />
+    <PackageReference Include="System.Configuration.ConfigurationManager" Version="9.0.0" />
   </ItemGroup>
 
 </Project>

src/System.Private.ServiceModel/tools/CertificateGenerator/CertificateGeneratorLibrary/CertificateCreationSettings.cs

@@ -5,7 +5,6 @@
 
 using System;
 using System.Collections.Generic;
-using Org.BouncyCastle.Asn1.X509;
 
 namespace WcfTestCommon
 {
@@ -24,7 +23,8 @@ public CertificateCreationSettings()
         public DateTime ValidityNotAfter { get; set; }
         public CertificateValidityType ValidityType { get; set; }
         public bool IncludeCrlDistributionPoint { get; set; } = true;
-        public List<KeyPurposeID> EKU { get; set; }
+        // List of EKU OIDs (e.g., "1.3.6.1.5.5.7.3.1" for serverAuth, "1.3.6.1.5.5.7.3.2" for clientAuth).
+        public List<string> EKU { get; set; }
     }
 
     [Serializable]