Fix TlsSessionTests TLS resume flakiness by using a unique SNI - #132749
Merged
Merged
Conversation
ServerSession_TlsResume_HonorsAllowTlsResumeOption used the server certificate's name as the client TargetHost. The client-side OpenSSL session cache lives on a process-wide SSL_CTX keyed only by protocols and client certificate, and holds a single session per SNI name, so a test running concurrently in the same assembly could overwrite the cached ticket with one issued by its own server. The second handshake then offered a ticket this server could not decrypt, falling back to a full handshake with a larger ClientHello. Use a unique SNI name per run, matching SslStreamTlsResumeTests. Fixes dotnet#132111 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: Successfully started running 4 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
rzikm
enabled auto-merge (squash)
August 25, 2026 14:16
Contributor
|
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses flakiness in System.Net.Security.Tests TLS session resumption testing by ensuring the client’s SNI (TargetHost) is unique per test invocation, reducing cross-test interference when tests run in parallel.
Changes:
- Replace the previous
TargetHostvalue (derived from the server certificate name) with a per-run unique value (Guid.NewGuid().ToString("N")). - Rename
MeasureHandshakeBytesAsyncparameter fromserverNametotargetHostand update call sites for clarity.
wfurt
approved these changes
Aug 25, 2026
Member
|
/backport to release/11.0 |
Contributor
|
Started backporting to |
4 tasks
ViveliDuCh
pushed a commit
that referenced
this pull request
Sep 22, 2026
…ique SNI (#134369) Backport of #132749 to release/11.0 /cc @ViveliDuCh @rzikm ## Customer Impact - [ ] Customer reported - [ ] Found internally [Select one or both of the boxes. Describe how this issue impacts customers, citing the expected and actual behaviors and scope of the issue. If customer-reported, provide the issue number.] ## Regression - [ ] Yes - [ ] No [If yes, specify when the regression was introduced. Provide the PR or commit if known.] ## Testing [How was the fix verified? How was the issue missed previously? What tests were added?] ## Risk [High/Medium/Low. Justify the indication by mentioning how risks were measured and addressed.] **IMPORTANT**: If this backport is for a servicing release, please verify that: - For .NET 8 and .NET 9: The PR target branch is `release/X.0-staging`, not `release/X.0`. - For .NET 10+: The PR target branch is `release/X.0` (no `-staging` suffix). ## Package authoring no longer needed in .NET 9 **IMPORTANT**: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version. Keep in mind that we still need package authoring in .NET 8 and older versions. Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #132111
Root cause
This is a test isolation bug, not a product bug.
ServerSession_TlsResume_HonorsAllowTlsResumeOptionused the server certificate's name as the clientTargetHost. On Linux the client-side OpenSSL session cache lives on a process-wideSSL_CTX, keyed only by(isClient, protocols, client certificate)(Interop.OpenSsl.cs), and that context holds a single session per SNI name (SafeSslContextHandle._sslSessions).Test classes in this assembly run in parallel, and ~85 call sites use a non-unique
TargetHost. So a concurrently running test could overwrite this test's cached ticket with one issued by its own server. The second handshake then offered a ticket that this test's server could not decrypt, so it fell back to a full handshake — and the ClientHello was larger than the first one because of thepre_shared_keyextension, which is why the reported failure shows the second handshake exceeding the first.Verification
I reproduced the failure deterministically with a temporary test that poisons the cache in exactly that way (a client with the same protocols and no client certificate connecting to a different server under the same SNI, in between the two measured handshakes). It reproduced the CI failure byte-for-byte:
which is identical to the numbers reported in #132111. The temporary repro is not part of this change.
Fix
Use a unique SNI name per run, matching the existing precedent in
SslStreamTlsResumeTests, which already does this for the same reason.Testing
On Linux x64:
./build.sh clr+libs -rc release— succeededServerSession_TlsResume_HonorsAllowTlsResumeOption, all 4 cases — passSystem.Net.Security.Tests(5041 tests) — cleanNote
This pull request description was generated with the assistance of GitHub Copilot.