improve handling of TLS certificates on Linux #74695
Conversation
|
Tagging subscribers to this area: @dotnet/ncl, @vcsjones Issue DetailsI bump to this when looking at memory use on Linux. To solve that I added custom marshaling (big thanks to @jkoritzinsky for guidance) On client we would typically get valid certificate. I would be curious if there is better way @bartonjs.
|
src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Ssl.cs
Outdated
Show resolved
Hide resolved
src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Ssl.cs
Outdated
Show resolved
Hide resolved
src/libraries/System.Net.Security/src/System/Net/CertificateValidationPal.Unix.cs
Outdated
Show resolved
Hide resolved
src/libraries/System.Net.Security/src/System/Net/CertificateValidationPal.Unix.cs
Outdated
Show resolved
Hide resolved
…lidationPal.Unix.cs Co-authored-by: Jeremy Barton <jbarton@microsoft.com>
wfurt
changed the title
ghost
locked as resolved and limited conversation to collaborators
6 participants
I bump to this when looking at memory use on Linux.
There re two parts:
On server the PeerCertificate would typically be null. Current marshaling would allocate
SafeX509Handlein invalid state. And then we would would wrap inSafeFreeCertContextjust to find out there is no certificate.To solve that I added custom marshaling (big thanks to @jkoritzinsky for guidance)
I tried generic on but failed (#74694) so this not has marshaling just for the certificates.
On client we would typically get valid certificate.
We get the
SafeX509Handle, then we wrap it inSafeFreeCertContextjust to callDangerousGetHandle().I'm wondering if we even need
SafeHandlehere but using two seems obsessive. For now, I useSafeX509Handlein pattern similar as before withSafeFreeCertContextgone.I would be curious if there is better way @bartonjs.