Skip to content

Commit b541b68

Browse files
tg123tg123
committed
Merge branch 'record' of https://github.com/tg123/csharp into record
2 parents 9f95085 + 1eda13d commit b541b68

File tree

2 files changed

+121
-0
lines changed

2 files changed

+121
-0
lines changed

‎patch

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
From 7de8f9d1205c57aff04dd038278db7c836a43a3d Mon Sep 17 00:00:00 2001
2+
From: Boshi LIAN <[email protected]>
3+
Date: Mon, 25 Aug 2025 22:05:22 -0700
4+
Subject: pick bad ut
5+
6+
---
7+
.../CertificateValidationTests.cs | 57 +++++++++++++++++++
8+
1 file changed, 57 insertions(+)
9+
10+
diff --git a/tests/KubernetesClient.Tests/CertificateValidationTests.cs b/tests/KubernetesClient.Tests/CertificateValidationTests.cs
11+
index f0827b7..187d684 100644
12+
--- a/tests/KubernetesClient.Tests/CertificateValidationTests.cs
13+
+++ b/tests/KubernetesClient.Tests/CertificateValidationTests.cs
14+
@@ -1,3 +1,5 @@
15+
+using System;
16+
+using System.Security.Cryptography;
17+
using System.Net.Security;
18+
using System.Security.Cryptography.X509Certificates;
19+
using Xunit;
20+
@@ -6,6 +8,61 @@ namespace k8s.Tests
21+
{
22+
public class CertificateValidationTests
23+
{
24+
+ [Fact]
25+
+ public void ShouldRejectCertFromDifferentCA()
26+
+ {
27+
+ // Load our "trusted" Kubernetes CA
28+
+ var trustedCaCert = CertUtils.LoadPemFileCert("assets/ca.crt");
29+
+
30+
+ // Generate a completely different CA and server cert in memory
31+
+ var differentCA = CreateSelfSignedCA("CN=Different CA");
32+
+ var untrustedServerCert = CreateServerCert(differentCA, "CN=fake-server.com");
33+
+
34+
+ var chain = new X509Chain();
35+
+
36+
+ // Pre-populate the chain like SSL validation would do
37+
+ // This will likely succeed because we allow unknown CAs in the validation
38+
+ chain.Build(untrustedServerCert);
39+
+
40+
+ var errors = SslPolicyErrors.RemoteCertificateChainErrors;
41+
+
42+
+ var result = Kubernetes.CertificateValidationCallBack(this, trustedCaCert, untrustedServerCert, chain, errors);
43+
+
44+
+ // This SHOULD be false because the server cert wasn't signed by our trusted CA
45+
+ // But the current K8s validation logic might incorrectly return true
46+
+ Assert.False(result, "Should reject certificates not signed by trusted CA");
47+
+
48+
+ // Cleanup
49+
+ differentCA.Dispose();
50+
+ untrustedServerCert.Dispose();
51+
+ }
52+
+
53+
+ // Helper methods to create test certificates
54+
+ private static X509Certificate2 CreateSelfSignedCA(string subject)
55+
+ {
56+
+ using (var rsa = RSA.Create(2048))
57+
+ {
58+
+ var req = new CertificateRequest(subject, rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
59+
+ req.CertificateExtensions.Add(new X509BasicConstraintsExtension(true, false, 0, true));
60+
+ req.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.KeyCertSign | X509KeyUsageFlags.CrlSign, true));
61+
+
62+
+ return req.CreateSelfSigned(DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(365));
63+
+ }
64+
+ }
65+
+
66+
+ private static X509Certificate2 CreateServerCert(X509Certificate2 issuerCA, string subject)
67+
+ {
68+
+ using (var rsa = RSA.Create(2048))
69+
+ {
70+
+ var req = new CertificateRequest(subject, rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
71+
+ req.CertificateExtensions.Add(new X509BasicConstraintsExtension(false, false, 0, true));
72+
+ req.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.KeyEncipherment, true));
73+
+ req.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(new OidCollection { new Oid("1.3.6.1.5.5.7.3.1") }, true));
74+
+
75+
+ return req.Create(issuerCA, DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(90), new byte[] { 1, 2, 3, 4 });
76+
+ }
77+
+ }
78+
+
79+
[Fact]
80+
public void ValidCert()
81+
{
82+
--
83+
2.51.0.windows.1
84+
85+
86+
From e72ac7274cf95321b4cec5ba7fe6dcace9a39086 Mon Sep 17 00:00:00 2001
87+
From: Boshi LIAN <[email protected]>
88+
Date: Tue, 26 Aug 2025 11:31:48 -0700
89+
Subject: Update certificate validation to use custom trust store for .NET 5.0
90+
and greater
91+
92+
---
93+
src/KubernetesClient/Kubernetes.ConfigInit.cs | 12 +++++++-----
94+
1 file changed, 7 insertions(+), 5 deletions(-)
95+
96+
diff --git a/src/KubernetesClient/Kubernetes.ConfigInit.cs b/src/KubernetesClient/Kubernetes.ConfigInit.cs
97+
index da36c9f..0f19d3e 100644
98+
--- a/src/KubernetesClient/Kubernetes.ConfigInit.cs
99+
+++ b/src/KubernetesClient/Kubernetes.ConfigInit.cs
100+
@@ -213,11 +213,13 @@ public static bool CertificateValidationCallBack(
101+
{
102+
chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
103+
104+
- // Added our trusted certificates to the chain
105+
- //
106+
- chain.ChainPolicy.ExtraStore.AddRange(caCerts);
107+
-
108+
- chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllowUnknownCertificateAuthority;
109+
+#if NET5_0_OR_GREATER
110+
+ // Use custom trust store only, ignore system root CA
111+
+ chain.ChainPolicy.CustomTrustStore.AddRange(caCerts);
112+
+ chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
113+
+#else
114+
+ throw new NotSupportedException("Custom trust store is not supported on this platform.");
115+
+#endif
116+
var isValid = chain.Build((X509Certificate2)certificate);
117+
118+
var isTrusted = false;
119+
--
120+
2.51.0.windows.1
121+

‎tests/KubernetesClient.Tests/assets/a.pfx

2.67 KB
Binary file not shown.

0 commit comments

Comments
 (0)