[release/11.0] Fix TlsSessionTests TLS resume flakiness by using a unique SNI - #134369
Merged
Merged
Conversation
Fixes #132111 ### Root cause This is a test isolation bug, not a product bug. `ServerSession_TlsResume_HonorsAllowTlsResumeOption` used the server certificate's name as the client `TargetHost`. On Linux the client-side OpenSSL session cache lives on a **process-wide `SSL_CTX`**, keyed only by `(isClient, protocols, client certificate)` ([`Interop.OpenSsl.cs`](https://github.com/dotnet/runtime/blob/main/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs)), and that context holds a **single session per SNI name** (`SafeSslContextHandle._sslSessions`). Test classes in this assembly run in parallel, and ~85 call sites use a non-unique `TargetHost`. So a concurrently running test could overwrite this test's cached ticket with one issued by *its own* server. The second handshake then offered a ticket that this test's server could not decrypt, so it fell back to a full handshake — and the ClientHello was *larger* than the first one because of the `pre_shared_key` extension, which is why the reported failure shows the second handshake exceeding the first. ### Verification I reproduced the failure deterministically with a temporary test that poisons the cache in exactly that way (a client with the same protocols and no client certificate connecting to a *different* server under the same SNI, in between the two measured handshakes). It reproduced the CI failure byte-for-byte: ``` Expected resumed handshake to be smaller. first=5513 second=5816 ``` which is identical to the numbers reported in #132111. The temporary repro is not part of this change. ### Fix Use a unique SNI name per run, matching the existing precedent in `SslStreamTlsResumeTests`, which already does this for the same reason. ### Testing On Linux x64: - Baseline `./build.sh clr+libs -rc release` — succeeded - `ServerSession_TlsResume_HonorsAllowTlsResumeOption`, all 4 cases — pass - Full `System.Net.Security.Tests` (5041 tests) — clean > [!NOTE] > This pull request description was generated with the assistance of GitHub Copilot. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: Successfully started running 4 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @karelz, @dotnet/ncl |
Member
|
Test only change. Adding servicing-approved. |
mrek-msft
approved these changes
Sep 21, 2026
wfurt
approved these changes
Sep 21, 2026
Member
|
/ba-g unrelated test failures tracked by #134367 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #132749 to release/11.0
/cc @ViveliDuCh @rzikm
Customer Impact
[Select one or both of the boxes. Describe how this issue impacts customers, citing the expected and actual behaviors and scope of the issue. If customer-reported, provide the issue number.]
Regression
[If yes, specify when the regression was introduced. Provide the PR or commit if known.]
Testing
[How was the fix verified? How was the issue missed previously? What tests were added?]
Risk
[High/Medium/Low. Justify the indication by mentioning how risks were measured and addressed.]
IMPORTANT: If this backport is for a servicing release, please verify that:
release/X.0-staging, notrelease/X.0.release/X.0(no-stagingsuffix).Package authoring no longer needed in .NET 9
IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.