Imported Upstream version 5.4.0.167

Former-commit-id: 5624ac747d633e885131e8349322922b6a59baaa

external/corefx/src/System.Net.Security/dir.props

@@ -2,7 +2,8 @@
 <Project ToolsVersion="14.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <Import Project="..\dir.props" />
   <PropertyGroup>
-    <AssemblyVersion>4.1.0.0</AssemblyVersion>
+    <AssemblyVersion>4.1.1.0</AssemblyVersion>
+    <AssemblyKey>MSFT</AssemblyKey>
     <IsNETCoreApp>true</IsNETCoreApp>
     <IsUAP>true</IsUAP>
   </PropertyGroup>

external/corefx/src/System.Net.Security/src/ILLinkTrim.xml

@@ -0,0 +1,12 @@
+<linker>
+  <assembly fullname="System.Net.Security">
+    <type fullname="System.Net.NTAuthentication">
+      <!-- Called through reflection by System.Net.Mail tests -->
+      <method name="GetOutgoingBlob" />
+      <method name="MakeSignature" />
+      <method name="VerifySignature" />
+    </type>
+    <!-- required by tests -->
+    <type fullname="System.Net.NetEventSource" />
+  </assembly>
+</linker>

external/corefx/src/System.Net.Security/src/System.Net.Security.csproj

@@ -9,7 +9,6 @@
   <PropertyGroup Condition=" '$(TargetsOSX)' == 'true' ">
     <DefineConstants>$(DefineConstants);SYSNETSECURITY_NO_OPENSSL</DefineConstants>
   </PropertyGroup>
-  <!-- Help VS understand available configurations -->
   <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'netcoreapp-OSX-Debug|AnyCPU'" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'netcoreapp-OSX-Release|AnyCPU'" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'netcoreapp-Unix-Debug|AnyCPU'" />

external/corefx/src/System.Net.Security/src/System/Net/CertificateValidationPal.Windows.cs

@@ -38,7 +38,8 @@ namespace System.Net
                     var eppStruct = new Interop.Crypt32.SSL_EXTRA_CERT_CHAIN_POLICY_PARA()
                     {
                         cbSize = (uint)sizeof(Interop.Crypt32.SSL_EXTRA_CERT_CHAIN_POLICY_PARA),
-                        dwAuthType = isServer ? Interop.Crypt32.AuthType.AUTHTYPE_SERVER : Interop.Crypt32.AuthType.AUTHTYPE_CLIENT,
+                        // Authenticate the remote party: (e.g. when operating in server mode, authenticate the client).
+                        dwAuthType = isServer ? Interop.Crypt32.AuthType.AUTHTYPE_CLIENT : Interop.Crypt32.AuthType.AUTHTYPE_SERVER,
                         fdwChecks = 0,
                         pwszServerName = null
                     };

external/corefx/src/System.Net.Security/src/System/Net/Security/NegoState.cs

@@ -113,7 +113,7 @@ namespace System.Net.Security
         {
             if (_exception != null && !_canRetryAuthentication)
             {
-                ExceptionDispatchInfo.Capture(_exception).Throw();
+                ExceptionDispatchInfo.Throw(_exception);
             }
 
             if (_context != null && _context.IsValidContext)
@@ -314,7 +314,7 @@ namespace System.Net.Security
         {
             if (_exception != null)
             {
-                ExceptionDispatchInfo.Capture(_exception).Throw();
+                ExceptionDispatchInfo.Throw(_exception);
             }
 
             if (authSucessCheck && !IsAuthenticated)
@@ -399,7 +399,7 @@ namespace System.Net.Security
             {
                 // Round-trip it through the SetException().
                 e = SetException(e);
-                ExceptionDispatchInfo.Capture(e).Throw();
+                ExceptionDispatchInfo.Throw(e);
             }
         }
 
@@ -690,7 +690,7 @@ namespace System.Net.Security
             }
 
             _canRetryAuthentication = true;
-            ExceptionDispatchInfo.Capture(exception).Throw();
+            ExceptionDispatchInfo.Throw(exception);
         }
 
         private static void WriteCallback(IAsyncResult transportResult)
@@ -717,7 +717,7 @@ namespace System.Net.Security
                 if (lazyResult.Result is Exception e)
                 {
                     authState._canRetryAuthentication = true;
-                    ExceptionDispatchInfo.Capture(e).Throw();
+                    ExceptionDispatchInfo.Throw(e);
                 }
 
                 authState.CheckCompletionBeforeNextReceive(lazyResult);

external/corefx/src/System.Net.Security/src/System/Net/Security/NegotiateStream.cs

@@ -625,7 +625,7 @@ namespace System.Net.Security
                 {
                     if (e is IOException)
                     {
-                        ExceptionDispatchInfo.Capture(e).Throw();
+                        ExceptionDispatchInfo.Throw(e);
                     }
 
                     throw new IOException(SR.net_io_read, e);
@@ -698,7 +698,7 @@ namespace System.Net.Security
                 {
                     if (e is IOException)
                     {
-                        ExceptionDispatchInfo.Capture(e).Throw();
+                        ExceptionDispatchInfo.Throw(e);
                     }
 
                     throw new IOException(SR.net_io_write, e);

external/corefx/src/System.Net.Security/src/System/Net/Security/SecureChannel.cs

@@ -48,6 +48,9 @@ namespace System.Net.Security
 
         private bool _refreshCredentialNeeded;
 
+        private readonly Oid _serverAuthOid = new Oid("1.3.6.1.5.5.7.3.1");
+        private readonly Oid _clientAuthOid = new Oid("1.3.6.1.5.5.7.3.2");
+
         internal SecureChannel(string hostname, bool serverMode, SslProtocols sslProtocols, X509Certificate serverCertificate, X509CertificateCollection clientCertificates, bool remoteCertRequired, bool checkCertName,
                                                   bool checkCertRevocationStatus, EncryptionPolicy encryptionPolicy, LocalCertSelectionCallback certSelectionDelegate)
         {
@@ -1009,6 +1012,10 @@ namespace System.Net.Security
                     chain = new X509Chain();
                     chain.ChainPolicy.RevocationMode = _checkCertRevocation ? X509RevocationMode.Online : X509RevocationMode.NoCheck;
                     chain.ChainPolicy.RevocationFlag = X509RevocationFlag.ExcludeRoot;
+
+                    // Authenticate the remote party: (e.g. when operating in server mode, authenticate the client).
+                    chain.ChainPolicy.ApplicationPolicy.Add(_serverMode ? _clientAuthOid : _serverAuthOid);
+
                     if (remoteCertificateStore != null)
                     {
                         chain.ChainPolicy.ExtraStore.AddRange(remoteCertificateStore);
@@ -1101,7 +1108,7 @@ namespace System.Net.Security
 
                 if (status.Exception != null)
                 {
-                    ExceptionDispatchInfo.Capture(status.Exception).Throw();
+                    ExceptionDispatchInfo.Throw(status.Exception);
                 }
 
                 return null;
@@ -1125,7 +1132,7 @@ namespace System.Net.Security
 
                 if (status.Exception != null)
                 {
-                    ExceptionDispatchInfo.Capture(status.Exception).Throw();
+                    ExceptionDispatchInfo.Throw(status.Exception);
                 }
 
                 return null;

external/corefx/src/System.Net.Security/src/System/Net/Security/SslState.cs

@@ -737,9 +737,7 @@ namespace System.Net.Security
                     KeyExchangeStrength);
             }
         }
-        //
-        //
-        //
+
         internal void InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
         {
             // No "artificial" timeouts implemented so far, InnerStream controls that.

external/corefx/src/System.Net.Security/src/System/Net/Security/SslStreamInternal.cs

@@ -203,7 +203,7 @@ namespace System.Net.Security
             {
                 if (e is IOException)
                 {
-                    ExceptionDispatchInfo.Capture(e).Throw();
+                    ExceptionDispatchInfo.Throw(e);
                 }
 
                 throw new IOException(SR.net_io_write, e);

external/corefx/src/System.Net.Security/src/System/Net/Security/SslStreamPal.Unix.cs

@@ -180,14 +180,39 @@ namespace System.Net.Security
 
         public static SecurityStatusPal ApplyAlertToken(ref SafeFreeCredentials credentialsHandle, SafeDeleteContext securityContext, TlsAlertType alertType, TlsAlertMessage alertMessage)
         {
-            // TODO (#12319): Not implemented.
+            // There doesn't seem to be an exposed API for writing an alert,
+            // the API seems to assume that all alerts are generated internally by
+            // SSLHandshake.
             return new SecurityStatusPal(SecurityStatusPalErrorCode.OK);
         }
 
         public static SecurityStatusPal ApplyShutdownToken(ref SafeFreeCredentials credentialsHandle, SafeDeleteContext securityContext)
         {
-            // TODO (#12319): Not implemented.
-            return new SecurityStatusPal(SecurityStatusPalErrorCode.OK);
+            SafeDeleteSslContext sslContext = ((SafeDeleteSslContext)securityContext);
+
+            // Unset the quiet shutdown option initially configured.
+            Interop.Ssl.SslSetQuietShutdown(sslContext.SslContext, 0);
+
+            int status = Interop.Ssl.SslShutdown(sslContext.SslContext);
+            if (status == 0)
+            {
+                // Call SSL_shutdown again for a bi-directional shutdown.
+                status = Interop.Ssl.SslShutdown(sslContext.SslContext);
+            }
+
+            if (status == 1)
+                return new SecurityStatusPal(SecurityStatusPalErrorCode.OK);
+
+            Interop.Ssl.SslErrorCode code = Interop.Ssl.SslGetError(sslContext.SslContext, status);
+            if (code == Interop.Ssl.SslErrorCode.SSL_ERROR_WANT_READ ||
+                code == Interop.Ssl.SslErrorCode.SSL_ERROR_WANT_WRITE)
+            {
+                return new SecurityStatusPal(SecurityStatusPalErrorCode.OK);
+            }
+            else
+            {
+                return new SecurityStatusPal(SecurityStatusPalErrorCode.InternalError, new Interop.OpenSsl.SslException((int)code));
+            }
         }
     }
 }

external/corefx/src/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs

@@ -402,8 +402,9 @@ namespace System.Net.Security
                     return SSPIWrapper.AcquireCredentialsHandle(GlobalSSPI.SSPISecureChannel, SecurityPackage, credUsage, secureCredential);
                 });
             }
-            catch
+            catch(Exception ex)
             {
+                Debug.Fail("AcquireCredentialsHandle failed.", ex.ToString());
                 return SSPIWrapper.AcquireCredentialsHandle(GlobalSSPI.SSPISecureChannel, SecurityPackage, credUsage, secureCredential);
             }
         }

external/corefx/src/System.Net.Security/src/System/Net/StreamFramer.cs

@@ -305,7 +305,7 @@ namespace System.Net
 
             if (workerResult.Result is Exception e)
             {
-                ExceptionDispatchInfo.Capture(e).Throw();
+                ExceptionDispatchInfo.Throw(e);
             }
 
             int size = (int)workerResult.Result;
@@ -451,7 +451,7 @@ namespace System.Net
 
                 if (workerResult.Result is Exception e)
                 {
-                    ExceptionDispatchInfo.Capture(e).Throw();
+                    ExceptionDispatchInfo.Throw(e);
                 }
             }
             else

external/corefx/src/System.Net.Security/src/System/Security/Authentication/AuthenticationException.cs

@@ -17,7 +17,10 @@ namespace System.Security.Authentication
         public AuthenticationException() { }
         public AuthenticationException(string message) : base(message) { }
         public AuthenticationException(string message, Exception innerException) : base(message, innerException) { }
-        protected AuthenticationException(SerializationInfo serializationInfo, StreamingContext streamingContext) : base(serializationInfo, streamingContext) { }
+        protected AuthenticationException(SerializationInfo serializationInfo, StreamingContext streamingContext) : base(serializationInfo, streamingContext)
+        {
+            throw new PlatformNotSupportedException();
+        }
     }
 
     /// <summary>
@@ -33,6 +36,9 @@ namespace System.Security.Authentication
         public InvalidCredentialException() { }
         public InvalidCredentialException(string message) : base(message) { }
         public InvalidCredentialException(string message, Exception innerException) : base(message, innerException) { }
-        protected InvalidCredentialException(SerializationInfo serializationInfo, StreamingContext streamingContext) : base(serializationInfo, streamingContext) { }
+        protected InvalidCredentialException(SerializationInfo serializationInfo, StreamingContext streamingContext) : base(serializationInfo, streamingContext)
+        {
+            throw new PlatformNotSupportedException();
+        }
     }
 }

external/corefx/src/System.Net.Security/src/System/Security/Authentication/ExtendedProtection/ExtendedProtectionPolicy.cs

@@ -80,28 +80,12 @@ namespace System.Security.Authentication.ExtendedProtection
 
         protected ExtendedProtectionPolicy(SerializationInfo info, StreamingContext context)
         {
-            _policyEnforcement = (PolicyEnforcement)info.GetInt32(policyEnforcementName);
-            _protectionScenario = (ProtectionScenario)info.GetInt32(protectionScenarioName);
-            _customServiceNames = (ServiceNameCollection)info.GetValue(customServiceNamesName, typeof(ServiceNameCollection));
-
-            byte[] channelBindingData = (byte[])info.GetValue(customChannelBindingName, typeof(byte[]));
-            if (channelBindingData != null)
-            {
-                throw new PlatformNotSupportedException();
-            }
+            throw new PlatformNotSupportedException();
         }
 
         void ISerializable.GetObjectData(SerializationInfo info, StreamingContext context)
         {
-            if (_customChannelBinding != null)
-            {
-                throw new PlatformNotSupportedException();
-            }
-
-            info.AddValue(policyEnforcementName, (int)_policyEnforcement);
-            info.AddValue(protectionScenarioName, (int)_protectionScenario);
-            info.AddValue(customServiceNamesName, _customServiceNames, typeof(ServiceNameCollection));
-            info.AddValue(customChannelBindingName, null, typeof(byte[]));
+            throw new PlatformNotSupportedException();
         }
 
         public ServiceNameCollection CustomServiceNames

external/corefx/src/System.Net.Security/tests/FunctionalTests/CertificateValidationClientServer.cs

@@ -41,6 +41,7 @@ namespace System.Net.Security.Tests
         [Theory]
         [InlineData(false)]
         [InlineData(true)]
+        [SkipOnTargetFramework(TargetFrameworkMonikers.UapAot, "https://github.com/dotnet/corefx/issues/19379")]
         public async Task CertificateValidationClientServer_EndToEnd_Ok(bool useClientSelectionCallback)
         {
             IPEndPoint endPoint = new IPEndPoint(IPAddress.IPv6Loopback, 0);

external/corefx/src/System.Net.Security/tests/FunctionalTests/CertificateValidationRemoteServer.cs

@@ -16,6 +16,7 @@ namespace System.Net.Security.Tests
     public class CertificateValidationRemoteServer
     {
         [Fact]
+        [SkipOnTargetFramework(TargetFrameworkMonikers.UapAot, "https://github.com/dotnet/corefx/issues/19379")]
         public async Task CertificateValidationRemoteServer_EndToEnd_Ok()
         {
             using (var client = new TcpClient(AddressFamily.InterNetwork))

external/corefx/src/System.Net.Security/tests/FunctionalTests/ClientAsyncAuthenticateTest.cs

@@ -25,12 +25,14 @@ namespace System.Net.Security.Tests
         }
 
         [Fact]
+        [SkipOnTargetFramework(TargetFrameworkMonikers.UapAot, "https://github.com/dotnet/corefx/issues/19379")]
         public async Task ClientAsyncAuthenticate_ServerRequireEncryption_ConnectWithEncryption()
         {
             await ClientAsyncSslHelper(EncryptionPolicy.RequireEncryption);
         }
 
         [Fact]
+        [SkipOnTargetFramework(TargetFrameworkMonikers.UapAot, "https://github.com/dotnet/corefx/issues/19379")]
         public async Task ClientAsyncAuthenticate_ServerNoEncryption_NoConnect()
         {
             await Assert.ThrowsAsync<IOException>(() => ClientAsyncSslHelper(EncryptionPolicy.NoEncryption));

external/corefx/src/System.Net.Security/tests/FunctionalTests/ClientDefaultEncryptionTest.cs

@@ -34,6 +34,7 @@ namespace System.Net.Security.Tests
         }
 
         [Fact]
+        [SkipOnTargetFramework(TargetFrameworkMonikers.UapAot, "https://github.com/dotnet/corefx/issues/19379")]
         public async Task ClientDefaultEncryption_ServerRequireEncryption_ConnectWithEncryption()
         {
             using (var serverRequireEncryption = new DummyTcpServer(
@@ -75,6 +76,7 @@ namespace System.Net.Security.Tests
         }
 
         [Fact]
+        [SkipOnTargetFramework(TargetFrameworkMonikers.UapAot, "https://github.com/dotnet/corefx/issues/19379")]
         public async Task ClientDefaultEncryption_ServerNoEncryption_NoConnect()
         {
             using (var serverNoEncryption = new DummyTcpServer(

external/corefx/src/System.Net.Security/tests/FunctionalTests/LoggingTest.cs

@@ -12,7 +12,7 @@ namespace System.Net.Security.Tests
     public class LoggingTest : RemoteExecutorTestBase
     {
         [Fact]
-        [SkipOnTargetFramework(TargetFrameworkMonikers.NetFramework, "NetEventSource is only part of .NET Core")]
+        [SkipOnTargetFramework(TargetFrameworkMonikers.NetFramework | TargetFrameworkMonikers.UapAot, "NetEventSource is only part of .NET Core")] //"https://github.com/dotnet/corefx/issues/19379"
         public void EventSource_ExistsWithCorrectId()
         {
             Type esType = typeof(SslStream).Assembly.GetType("System.Net.NetEventSource", throwOnError: true, ignoreCase: false);
@@ -26,7 +26,6 @@ namespace System.Net.Security.Tests
 
         [Fact]
         [SkipOnTargetFramework(TargetFrameworkMonikers.NetFramework, "NetEventSource is only part of .NET Core")]
-        [ActiveIssue(16516, TestPlatforms.Windows)]
         public void EventSource_EventsRaisedAsExpected()
         {
             RemoteInvoke(() =>

external/corefx/src/System.Net.Security/tests/FunctionalTests/NegotiateStreamStreamToStreamTest.cs

@@ -72,6 +72,7 @@ namespace System.Net.Security.Tests
         }
 
         [Fact]
+        [SkipOnTargetFramework(TargetFrameworkMonikers.UapAot, "https://github.com/dotnet/corefx/issues/19379")]
         public void NegotiateStream_StreamToStream_Authentication_TargetName_Success()
         {
             string targetName = "testTargetName";
@@ -126,6 +127,7 @@ namespace System.Net.Security.Tests
         }
 
         [Fact]
+        [SkipOnTargetFramework(TargetFrameworkMonikers.NetFramework, ".NET Core difference in behavior: https://github.com/dotnet/corefx/issues/5241")]
         public void NegotiateStream_StreamToStream_Authentication_EmptyCredentials_Fails()
         {
             string targetName = "testTargetName";
@@ -272,6 +274,7 @@ namespace System.Net.Security.Tests
         }
 
         [Fact]
+        [SkipOnTargetFramework(TargetFrameworkMonikers.NetFramework, "Relies on FlushAsync override not available in desktop")]
         public void NegotiateStream_StreamToStream_FlushAsync_Propagated()
         {
             VirtualNetwork network = new VirtualNetwork();