Repository navigation
[Android] Fix SslStream handshake connection info queries on older Android versions - #136517
Open
simonrozsival wants to merge 1 commit into
Open
simonrozsival wants to merge 1 commit into
simonrozsival wants to merge 1 commit into
Conversation
Avoid querying incomplete handshake cipher information during certificate validation on Android API 24, 25, 27, and 28. Preserve early metadata on API 26 and 29+ and keep the handshake-completion refresh unchanged. Expand Android root-trust coverage across protocols and client/server validation roles, including callback-time metadata and encrypted data exchange. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5d1eb39b-b333-42a0-b862-cefce2a6c517
|
Azure Pipelines: Successfully started running 4 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones |
simonrozsival
changed the title
rzikm
approved these changes
Oct 27, 2026
wfurt
approved these changes
Oct 27, 2026
Member
Author
|
/azp run runtime-android |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Member
Author
|
/azp run runtime-android |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Avoid querying negotiated connection information from Android's handshake session during certificate validation when the platform cannot supply a valid cipher:
(NONE)), API 27 (native null-cipher crash), and API 28 (SSL_NULL_WITH_NULL_NULL).SslStream.Android.cs, with an Android-only call from shared code. Expand the existing root-trust regression across protocols and client/server validation roles, checking callback metadata, final connection information, and bidirectional encrypted data.Certificate-validation timing and policy are unchanged. This PR contains only the connection-info query fix; separate rejection/exception-handling hangs discovered during testing are not addressed here.
Validation
All results below are from the isolated patch in this PR, without the separate rejection-handling changes.
Full-suite execution on every Android API and other architectures was not performed for this isolated patch. Existing rejection-path hangs on other Android versions are deferred to a separate fix; no tests were disabled.
Fixes #136456
Note
This PR and its description were prepared with GitHub Copilot.