From 7f5ccbde792c7fd94ec27c33861ae1c3118ecf93 Mon Sep 17 00:00:00 2001

From: Filip Navara <filip.navara@gmail.com>

Date: Sun, 24 Jun 2018 06:29:39 +0200

Subject: [PATCH 1/7] NetFX compatibility fixes for X500DistinguishedName.

* Don't write a separator after the empty DN

* Make T61String behave like it does on Windows (UTF-8 with a Latin-1 fallback)

* Use the managed decoder on Linux, instead of a lot of P/Invokes back into OpenSSL.

---

 .../Interop.ASN1.cs                           |  27 ----

 .../Interop.X509Name.cs                       |  39 ------

 .../Interop.X509NameEntry.cs                  |  61 ---------

 .../SafeHandles/SafeX509NameHandle.Unix.cs    |  30 -----

 .../Cryptography/DerSequenceReader.cs         |  35 +++++

 .../pal_x509_name.cpp                         |   5 +

 .../pal_x509_name.h                           |   5 +

 .../src/System.Net.Http.csproj                |   3 -

 .../src/System.Net.Security.csproj            |   3 -

 ...em.Security.Cryptography.Algorithms.csproj |   1 +

 ...stem.Security.Cryptography.Encoding.csproj |   1 +

 ...ystem.Security.Cryptography.OpenSsl.csproj |   1 +

 .../Pal.Unix/X500NameEncoder.ManagedDecode.cs |   4 +-

 .../Pal.Unix/X500NameEncoder.OpenSslDecode.cs | 123 ------------------

 .../Cryptography/Pal.Unix/X500NameEncoder.cs  |   7 +-

 ...urity.Cryptography.X509Certificates.csproj |  10 +-

 .../tests/X500DistinguishedNameTests.cs       |  69 ++++++++++

 17 files changed, 125 insertions(+), 299 deletions(-)

 delete mode 100644 src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509NameEntry.cs

 delete mode 100644 src/Common/src/Microsoft/Win32/SafeHandles/SafeX509NameHandle.Unix.cs

 delete mode 100644 src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.OpenSslDecode.cs

diff --git a/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.ASN1.cs b/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.ASN1.cs

index 962eaa426f..5bd2e8b9b4 100644

--- a/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.ASN1.cs

+++ b/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.ASN1.cs

@@ -61,22 +61,6 @@ internal static partial class Interop

         [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_Asn1StringFree")]

         internal static extern void Asn1StringFree(IntPtr o);

-        internal static string GetOidValue(SafeSharedAsn1ObjectHandle asn1Object)

-        {

-            Debug.Assert(asn1Object != null);

-

-            bool added = false;

-            asn1Object.DangerousAddRef(ref added);

-            try

-            {

-                return GetOidValue(asn1Object.DangerousGetHandle());

-            }

-            finally

-            {

-                asn1Object.DangerousRelease();

-            }

-        }

-

         internal static unsafe string GetOidValue(IntPtr asn1ObjectPtr)

         {

             // OBJ_obj2txt returns the number of bytes that should have been in the answer, but it does not accept

@@ -127,14 +111,3 @@ internal static partial class Interop

         }

     }

 }

-

-namespace Microsoft.Win32.SafeHandles

-{

-    internal class SafeSharedAsn1ObjectHandle : SafeInteriorHandle

-    {

-        private SafeSharedAsn1ObjectHandle() :

-            base(IntPtr.Zero, ownsHandle: true)

-        {

-        }

-    }

-}

diff --git a/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509Name.cs b/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509Name.cs

index 0f0fecad24..70097d7db2 100644

--- a/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509Name.cs

+++ b/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509Name.cs

@@ -15,16 +15,6 @@ internal static partial class Interop

         [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_GetX509NameStackFieldCount")]

         internal static extern int GetX509NameStackFieldCount(SafeSharedX509NameStackHandle sk);

-        [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_PushX509NameStackField")]

-        [return: MarshalAs(UnmanagedType.Bool)]

-        internal static extern bool PushX509NameStackField(SafeX509NameStackHandle stack, SafeX509NameHandle x509_Name);

-

-        [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_RecursiveFreeX509NameStack")]

-        internal static extern void RecursiveFreeX509NameStack(IntPtr stack);

-

-        [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_NewX509NameStack")]

-        internal static extern SafeX509NameStackHandle NewX509NameStack();

-

         [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_GetX509NameStackField")]

         private static extern SafeSharedX509NameHandle GetX509NameStackField_private(SafeSharedX509NameStackHandle sk,

             int loc);

@@ -32,15 +22,6 @@ internal static partial class Interop

         [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_GetX509NameRawBytes")]

         private static extern int GetX509NameRawBytes(SafeSharedX509NameHandle x509Name, byte[] buf, int cBuf);

-        [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_DecodeX509Name")]

-        internal static extern SafeX509NameHandle DecodeX509Name(byte[] buf, int len);

-

-        [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_X509NameDestroy")]

-        internal static extern void X509NameDestroy(IntPtr a);

-

-        [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_GetX509NameEntryCount")]

-        internal static extern int GetX509NameEntryCount(SafeX509NameHandle x509Name);

-

         internal static X500DistinguishedName LoadX500Name(SafeSharedX509NameHandle namePtr)

         {

             CheckValidOpenSslHandle(namePtr);

@@ -86,25 +67,5 @@ namespace Microsoft.Win32.SafeHandles

         {

         }

     }

-

-    internal sealed class SafeX509NameStackHandle : SafeHandle

-    {

-        private SafeX509NameStackHandle() :

-            base(IntPtr.Zero, ownsHandle: true)

-        {

-        }

-

-        protected override bool ReleaseHandle()

-        {

-            Interop.Crypto.RecursiveFreeX509NameStack(handle);

-            SetHandle(IntPtr.Zero);

-            return true;

-        }

-

-        public override bool IsInvalid

-        {

-            get { return handle == IntPtr.Zero; }

-        }

-    }

 }

diff --git a/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509NameEntry.cs b/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509NameEntry.cs

deleted file mode 100644

index eeeea54d0c..0000000000

--- a/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509NameEntry.cs

+++ /dev/null

@@ -1,61 +0,0 @@

-// Licensed to the .NET Foundation under one or more agreements.

-// The .NET Foundation licenses this file to you under the MIT license.

-// See the LICENSE file in the project root for more information.

-

-using System;

-using System.Runtime.InteropServices;

-using Microsoft.Win32.SafeHandles;

-

-internal static partial class Interop

-{

-    internal static partial class Crypto

-    {

-        [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_GetX509NameEntry")]

-        private static extern SafeSharedX509NameEntryHandle GetX509NameEntry_private(SafeX509NameHandle x509Name, int loc);

-

-        [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_GetX509NameEntryOid")]

-        private static extern SafeSharedAsn1ObjectHandle GetX509NameEntryOid_private(SafeSharedX509NameEntryHandle nameEntry);

-

-        [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_GetX509NameEntryData")]

-        private static extern SafeSharedAsn1StringHandle GetX509NameEntryData_private(SafeSharedX509NameEntryHandle nameEntry);

-

-        internal static SafeSharedX509NameEntryHandle GetX509NameEntry(SafeX509NameHandle x509Name, int loc)

-        {

-            CheckValidOpenSslHandle(x509Name);

-

-            return SafeInteriorHandle.OpenInteriorHandle(

-                (nameHandle, i) => GetX509NameEntry_private(nameHandle, i),

-                x509Name,

-                loc);

-        }

-

-        internal static SafeSharedAsn1ObjectHandle GetX509NameEntryOid(SafeSharedX509NameEntryHandle nameEntry)

-        {

-            CheckValidOpenSslHandle(nameEntry);

-

-            return SafeInteriorHandle.OpenInteriorHandle(

-                handle => GetX509NameEntryOid_private(handle),

-                nameEntry);

-        }

-

-        internal static SafeSharedAsn1StringHandle GetX509NameEntryData(SafeSharedX509NameEntryHandle nameEntry)

-        {

-            CheckValidOpenSslHandle(nameEntry);

-

-            return SafeInteriorHandle.OpenInteriorHandle(

-                handle => GetX509NameEntryData_private(handle),

-                nameEntry);

-        }

-    }

-}

-

-namespace Microsoft.Win32.SafeHandles

-{

-    internal sealed class SafeSharedX509NameEntryHandle : SafeInteriorHandle

-    {

-        private SafeSharedX509NameEntryHandle() :

-            base(IntPtr.Zero, ownsHandle: true)

-        {

-        }

-    }

-}

diff --git a/src/Common/src/Microsoft/Win32/SafeHandles/SafeX509NameHandle.Unix.cs b/src/Common/src/Microsoft/Win32/SafeHandles/SafeX509NameHandle.Unix.cs

deleted file mode 100644

index ae22b92303..0000000000

--- a/src/Common/src/Microsoft/Win32/SafeHandles/SafeX509NameHandle.Unix.cs

+++ /dev/null

@@ -1,30 +0,0 @@

-// Licensed to the .NET Foundation under one or more agreements.

-// The .NET Foundation licenses this file to you under the MIT license.

-// See the LICENSE file in the project root for more information.

-

-using System;

-using System.Security;

-using System.Runtime.InteropServices;

-

-namespace Microsoft.Win32.SafeHandles

-{

-    internal sealed class SafeX509NameHandle : SafeHandle

-    {

-        private SafeX509NameHandle() :

-            base(IntPtr.Zero, ownsHandle: true)

-        {

-        }

-

-        protected override bool ReleaseHandle()

-        {

-            Interop.Crypto.X509NameDestroy(handle);

-            SetHandle(IntPtr.Zero);

-            return true;

-        }

-

-        public override bool IsInvalid

-        {

-            get { return handle == IntPtr.Zero; }

-        }

-    }

-}

diff --git a/src/Common/src/System/Security/Cryptography/DerSequenceReader.cs b/src/Common/src/System/Security/Cryptography/DerSequenceReader.cs

index b68c9da093..68d9ac1bd2 100644

--- a/src/Common/src/System/Security/Cryptography/DerSequenceReader.cs

+++ b/src/Common/src/System/Security/Cryptography/DerSequenceReader.cs

@@ -30,6 +30,9 @@ namespace System.Security.Cryptography

         internal static DateTimeFormatInfo s_validityDateTimeFormatInfo;

+        private static System.Text.Encoding s_utf8EncodingWithExceptionFallback;

+        private static System.Text.Encoding s_latin1Encoding;

+

         private readonly byte[] _data;

         private readonly int _end;

         private int _position;

@@ -383,6 +386,38 @@ namespace System.Security.Cryptography

             return TrimTrailingNulls(ia5String);

         }

+        internal string ReadT61String()

+        {

+            EatTag(DerTag.T61String);

+            int contentLength = EatLength();

+            string t61String;

+

+            // Technically the T.61 encoding (code page 20261) should be used here, but many

+            // implementations don't follow that and use different character sets. CryptoAPI

+            // on NetFX seems to interpret it as UTF-8 with fallback to ISO 8859-1. OpenSSL

+            // seems to interpret it as ISO 8859-1 with no support for UTF-8.

+            // https://github.com/dotnet/corefx/issues/27466

+

+            System.Text.Encoding utf8EncodingWithExceptionFallback = LazyInitializer.EnsureInitialized(

+                ref s_utf8EncodingWithExceptionFallback,

+                () => new UTF8Encoding(false, true));

+            System.Text.Encoding latin1Encoding = LazyInitializer.EnsureInitialized(

+                ref s_latin1Encoding,

+                () => System.Text.Encoding.GetEncoding("iso-8859-1"));

+            

+            try

+            {

+                t61String = utf8EncodingWithExceptionFallback.GetString(_data, _position, contentLength);

+            }

+            catch (DecoderFallbackException)

+            {

+                t61String = latin1Encoding.GetString(_data, _position, contentLength);

+            }

+            _position += contentLength;

+

+            return TrimTrailingNulls(t61String);

+        }

+

         internal DateTime ReadX509Date()

         {

             byte tag = PeekTag();

diff --git a/src/Native/Unix/System.Security.Cryptography.Native/pal_x509_name.cpp b/src/Native/Unix/System.Security.Cryptography.Native/pal_x509_name.cpp

index 2195b74906..02cbfee4a2 100644

--- a/src/Native/Unix/System.Security.Cryptography.Native/pal_x509_name.cpp

+++ b/src/Native/Unix/System.Security.Cryptography.Native/pal_x509_name.cpp

@@ -14,6 +14,11 @@ extern "C" X509_NAME* CryptoNative_GetX509NameStackField(X509NameStack* sk, int3

     return sk_X509_NAME_value(sk, loc);

 }

+/*

+ * The following methods are kept around for compatiblity during servicing.

+ * They are not used.

+ */

+

 extern "C" X509_NAME* CryptoNative_DecodeX509Name(const uint8_t* buf, int32_t len)

 {

     if (!buf || !len)

diff --git a/src/Native/Unix/System.Security.Cryptography.Native/pal_x509_name.h b/src/Native/Unix/System.Security.Cryptography.Native/pal_x509_name.h

index 76a77ccc1f..b24a794bbd 100644

--- a/src/Native/Unix/System.Security.Cryptography.Native/pal_x509_name.h

+++ b/src/Native/Unix/System.Security.Cryptography.Native/pal_x509_name.h

@@ -18,6 +18,11 @@ Direct shim to sk_X509_NAME_value

 */

 extern "C" X509_NAME* CryptoNative_GetX509NameStackField(X509NameStack* sk, int32_t loc);

+/*

+ * The following methods are kept around for compatiblity during servicing.

+ * They are not used.

+ */

+

 /*

 Shims the d2i_X509_NAME method and makes it easier to invoke from managed code.

 */

diff --git a/src/System.Net.Http/src/System.Net.Http.csproj b/src/System.Net.Http/src/System.Net.Http.csproj

index 3fa7cdd26f..66e5b8d5f8 100644

--- a/src/System.Net.Http/src/System.Net.Http.csproj

+++ b/src/System.Net.Http/src/System.Net.Http.csproj

@@ -530,9 +530,6 @@

     <Compile Include="$(CommonPath)\Microsoft\Win32\SafeHandles\SafeX509Handles.Unix.cs">

       <Link>Common\Microsoft\Win32\SafeHandles\SafeX509Handles.Unix.cs</Link>

     </Compile>

-    <Compile Include="$(CommonPath)\Microsoft\Win32\SafeHandles\SafeX509NameHandle.Unix.cs">

-      <Link>Common\Microsoft\Win32\SafeHandles\SafeX509NameHandle.Unix.cs</Link>

-    </Compile>

     <Compile Include="$(CommonPath)\Microsoft\Win32\SafeHandles\X509ExtensionSafeHandles.Unix.cs">

       <Link>Common\Microsoft\Win32\SafeHandles\X509ExtensionSafeHandles.Unix.cs</Link>

     </Compile>

diff --git a/src/System.Net.Security/src/System.Net.Security.csproj b/src/System.Net.Security/src/System.Net.Security.csproj

index 9dff20160e..bf8d773a4e 100644

--- a/src/System.Net.Security/src/System.Net.Security.csproj

+++ b/src/System.Net.Security/src/System.Net.Security.csproj

@@ -328,9 +328,6 @@

     <Compile Include="$(CommonPath)\Microsoft\Win32\SafeHandles\SafeX509Handles.Unix.cs">

       <Link>Common\Microsoft\Win32\SafeHandles\SafeX509Handles.Unix.cs</Link>

     </Compile>

-    <Compile Include="$(CommonPath)\Microsoft\Win32\SafeHandles\SafeX509NameHandle.Unix.cs">

-      <Link>Common\Microsoft\Win32\SafeHandles\SafeX509NameHandle.Unix.cs</Link>

-    </Compile>

     <Compile Include="$(CommonPath)\Microsoft\Win32\SafeHandles\X509ExtensionSafeHandles.Unix.cs">

       <Link>Common\Microsoft\Win32\SafeHandles\X509ExtensionSafeHandles.Unix.cs</Link>

     </Compile>

diff --git a/src/System.Security.Cryptography.Algorithms/src/System.Security.Cryptography.Algorithms.csproj b/src/System.Security.Cryptography.Algorithms/src/System.Security.Cryptography.Algorithms.csproj

index 9b1cb26508..fbe6f4c269 100644

--- a/src/System.Security.Cryptography.Algorithms/src/System.Security.Cryptography.Algorithms.csproj

+++ b/src/System.Security.Cryptography.Algorithms/src/System.Security.Cryptography.Algorithms.csproj

@@ -558,6 +558,7 @@

     <Reference Include="System.Security.Cryptography.Encoding" />

     <Reference Include="System.Security.Cryptography.Primitives" />

     <Reference Include="System.Threading" />

+    <Reference Include="System.Text.Encoding.Extensions" />

   </ItemGroup>

   <ItemGroup Condition="'$(TargetsUnix)' == 'true'">

     <Reference Include="System.Runtime.Numerics" />

diff --git a/src/System.Security.Cryptography.Encoding/src/System.Security.Cryptography.Encoding.csproj b/src/System.Security.Cryptography.Encoding/src/System.Security.Cryptography.Encoding.csproj

index 9681ef62e4..388d4f36a6 100644

--- a/src/System.Security.Cryptography.Encoding/src/System.Security.Cryptography.Encoding.csproj

+++ b/src/System.Security.Cryptography.Encoding/src/System.Security.Cryptography.Encoding.csproj

@@ -106,6 +106,7 @@

     <Reference Include="System.Runtime.Extensions" />

     <Reference Include="System.Runtime.InteropServices" />

     <Reference Include="System.Security.Cryptography.Primitives" />

+    <Reference Include="System.Text.Encoding.Extensions" />

   </ItemGroup>

   <ItemGroup Condition=" '$(TargetsOSX)' == 'true' ">

     <Reference Include="System.Runtime.Numerics" />

diff --git a/src/System.Security.Cryptography.OpenSsl/src/System.Security.Cryptography.OpenSsl.csproj b/src/System.Security.Cryptography.OpenSsl/src/System.Security.Cryptography.OpenSsl.csproj

index 095d62bc6d..3846bcad23 100644

--- a/src/System.Security.Cryptography.OpenSsl/src/System.Security.Cryptography.OpenSsl.csproj

+++ b/src/System.Security.Cryptography.OpenSsl/src/System.Security.Cryptography.OpenSsl.csproj

@@ -160,6 +160,7 @@

     <Reference Include="System.Security.Cryptography.Algorithms" />

     <Reference Include="System.Security.Cryptography.Encoding" />

     <Reference Include="System.Security.Cryptography.Primitives" />

+    <Reference Include="System.Text.Encoding.Extensions" />

     <Reference Include="System.Threading" />

   </ItemGroup>

   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildThisFileDirectory), dir.targets))\dir.targets" />

diff --git a/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.ManagedDecode.cs b/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.ManagedDecode.cs

index 094e95c20d..0285415ba3 100644

--- a/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.ManagedDecode.cs

+++ b/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.ManagedDecode.cs

@@ -127,7 +127,7 @@ namespace Internal.Cryptography.Pal

                 }

             }

-            if (addTrailingDelimiter)

+            if (addTrailingDelimiter && decodedName.Length > 0)

             {

                 decodedName.Append(dnSeparator);

             }

@@ -150,7 +150,7 @@ namespace Internal.Cryptography.Pal

                 case DerSequenceReader.DerTag.UTF8String:

                     return tavReader.ReadUtf8String();

                 case DerSequenceReader.DerTag.T61String:

-                    return "";

+                    return tavReader.ReadT61String();

                 default:

                     throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding);

             }

diff --git a/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.OpenSslDecode.cs b/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.OpenSslDecode.cs

deleted file mode 100644

index 0c03283475..0000000000

--- a/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.OpenSslDecode.cs

+++ /dev/null

@@ -1,123 +0,0 @@

-// Licensed to the .NET Foundation under one or more agreements.

-// The .NET Foundation licenses this file to you under the MIT license.

-// See the LICENSE file in the project root for more information.

-

-using System.Text;

-

-using Microsoft.Win32.SafeHandles;

-

-namespace Internal.Cryptography.Pal

-{

-    internal static partial class X500NameEncoder

-    {

-        private static string X500DistinguishedNameDecode(

-            byte[] encodedName,

-            bool printOid,

-            bool reverse,

-            bool quoteIfNeeded,

-            string dnSeparator,

-            string multiValueSeparator,

-            bool addTrailingDelimiter)

-        {

-            using (SafeX509NameHandle x509Name = Interop.Crypto.DecodeX509Name(encodedName, encodedName.Length))

-            {

-                if (x509Name.IsInvalid)

-                {

-                    Interop.Crypto.ErrClearError();

-                    return "";

-                }

-

-                // We need to allocate a StringBuilder to hold the data as we're building it, and there's the usual

-                // arbitrary process of choosing a number that's "big enough" to minimize reallocations without wasting

-                // too much space in the average case.

-                //

-                // So, let's look at an example of what our output might be.

-                //

-                // GitHub.com's SSL cert has a "pretty long" subject (partially due to the unknown OIDs):

-                //   businessCategory=Private Organization

-                //   1.3.6.1.4.1.311.60.2.1.3=US

-                //   1.3.6.1.4.1.311.60.2.1.2=Delaware

-                //   serialNumber=5157550

-                //   street=548 4th Street

-                //   postalCode=94107

-                //   C=US

-                //   ST=California

-                //   L=San Francisco

-                //   O=GitHub, Inc.

-                //   CN=github.com

-                //

-                // Which comes out to 228 characters using OpenSSL's default pretty-print

-                // (openssl x509 -in github.cer -text -noout)

-                // Throw in some "maybe-I-need-to-quote-this" quotes, and a couple of extra/extra-long O/OU values

-                // and round that up to the next programmer number, and you get that 512 should avoid reallocations

-                // in all but the most dire of cases.

-                StringBuilder decodedName = new StringBuilder(512);

-                int entryCount = Interop.Crypto.GetX509NameEntryCount(x509Name);

-                bool printSpacing = false;

-

-                for (int i = 0; i < entryCount; i++)

-                {

-                    int loc = reverse ? entryCount - i - 1 : i;

-

-                    using (SafeSharedX509NameEntryHandle nameEntry = Interop.Crypto.GetX509NameEntry(x509Name, loc))

-                    {

-                        Interop.Crypto.CheckValidOpenSslHandle(nameEntry);

-

-                        string thisOidValue;

-

-                        using (SafeSharedAsn1ObjectHandle oidHandle = Interop.Crypto.GetX509NameEntryOid(nameEntry))

-                        {

-                            thisOidValue = Interop.Crypto.GetOidValue(oidHandle);

-                        }

-

-                        if (printSpacing)

-                        {

-                            decodedName.Append(dnSeparator);

-                        }

-                        else

-                        {

-                            printSpacing = true;

-                        }

-

-                        if (printOid)

-                        {

-                            AppendOid(decodedName, thisOidValue);

-                        }

-

-                        string rdnValue;

-

-                        using (SafeSharedAsn1StringHandle valueHandle = Interop.Crypto.GetX509NameEntryData(nameEntry))

-                        {

-                            rdnValue = Interop.Crypto.Asn1StringToManagedString(valueHandle);

-                        }

-

-                        bool quote = quoteIfNeeded && NeedsQuoting(rdnValue);

-

-                        if (quote)

-                        {

-                            decodedName.Append('"');

-

-                            // If the RDN itself had a quote within it, that quote needs to be escaped

-                            // with another quote.

-                            rdnValue = rdnValue.Replace("\"", "\"\"");

-                        }

-

-                        decodedName.Append(rdnValue);

-

-                        if (quote)

-                        {

-                            decodedName.Append('"');

-                        }

-                    }

-                }

-

-                if (addTrailingDelimiter)

-                {

-                    decodedName.Append(dnSeparator);

-                }

-

-                return decodedName.ToString();

-            }

-        }

-    }

-}

diff --git a/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.cs b/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.cs

index 56da9ae40c..005e09abe3 100644

--- a/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.cs

+++ b/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/X500NameEncoder.cs

@@ -40,7 +40,7 @@ namespace Internal.Cryptography.Pal

             byte[] encodedName,

             bool printOid,

             X500DistinguishedNameFlags flags,

-            bool addTrailingDelimieter=false)

+            bool addTrailingDelimiter = false)

         {

             bool reverse = (flags & X500DistinguishedNameFlags.Reversed) == X500DistinguishedNameFlags.Reversed;

             bool quoteIfNeeded = (flags & X500DistinguishedNameFlags.DoNotUseQuotes) != X500DistinguishedNameFlags.DoNotUseQuotes;

@@ -51,7 +51,8 @@ namespace Internal.Cryptography.Pal

             {

                 dnSeparator = "; ";

             }

-            else if ((flags & X500DistinguishedNameFlags.UseNewLines) == X500DistinguishedNameFlags.UseNewLines)

+            // Explicit UseCommas has preference over explicit UseNewLines.

+            else if ((flags & (X500DistinguishedNameFlags.UseNewLines | X500DistinguishedNameFlags.UseCommas)) == X500DistinguishedNameFlags.UseNewLines)

             {

                 dnSeparator = Environment.NewLine;

             }

@@ -73,7 +74,7 @@ namespace Internal.Cryptography.Pal

                     quoteIfNeeded,

                     dnSeparator,

                     multiValueSparator,

-                    addTrailingDelimieter);

+                    addTrailingDelimiter);

             }

             catch (CryptographicException)

             {

diff --git a/src/System.Security.Cryptography.X509Certificates/src/System.Security.Cryptography.X509Certificates.csproj b/src/System.Security.Cryptography.X509Certificates/src/System.Security.Cryptography.X509Certificates.csproj

index 20b0328943..3bdef009b9 100644

--- a/src/System.Security.Cryptography.X509Certificates/src/System.Security.Cryptography.X509Certificates.csproj

+++ b/src/System.Security.Cryptography.X509Certificates/src/System.Security.Cryptography.X509Certificates.csproj

@@ -169,7 +169,6 @@

     <Compile Include="Internal\Cryptography\Pal.Unix\PkcsFormatReader.cs" />

     <Compile Include="Internal\Cryptography\Pal.Unix\SingleCertLoader.cs" />

     <Compile Include="Internal\Cryptography\Pal.Unix\StorePal.cs" />

-    <Compile Include="Internal\Cryptography\Pal.Unix\X500NameEncoder.OpenSslDecode.cs" />

     <Compile Include="Internal\Cryptography\Pal.Unix\X509Pal.cs" />

     <Compile Include="Internal\Cryptography\Pal.Unix\X509Persistence.cs" />

     <Compile Include="$(CommonPath)\Interop\Unix\Interop.Libraries.cs">

@@ -223,9 +222,6 @@

     <Compile Include="$(CommonPath)\Interop\Unix\System.Security.Cryptography.Native\Interop.X509Name.cs">

       <Link>Common\Interop\Unix\System.Security.Cryptography.Native\Interop.X509Name.cs</Link>

     </Compile>

-    <Compile Include="$(CommonPath)\Interop\Unix\System.Security.Cryptography.Native\Interop.X509NameEntry.cs">

-      <Link>Common\Interop\Unix\System.Security.Cryptography.Native\Interop.X509NameEntry.cs</Link>

-    </Compile>

     <Compile Include="$(CommonPath)\Interop\Unix\System.Security.Cryptography.Native\Interop.X509Stack.cs">

       <Link>Common\Interop\Unix\System.Security.Cryptography.Native\Interop.X509Stack.cs</Link>

     </Compile>

@@ -274,9 +270,6 @@

     <Compile Include="$(CommonPath)\Microsoft\Win32\SafeHandles\SafeX509Handles.Unix.cs">

       <Link>Common\Microsoft\Win32\SafeHandles\SafeX509Handles.Unix.cs</Link>

     </Compile>

-    <Compile Include="$(CommonPath)\Microsoft\Win32\SafeHandles\SafeX509NameHandle.Unix.cs">

-      <Link>Common\Microsoft\Win32\SafeHandles\SafeX509NameHandle.Unix.cs</Link>

-    </Compile>

     <Compile Include="$(CommonPath)\Microsoft\Win32\SafeHandles\X509ExtensionSafeHandles.Unix.cs">

       <Link>Common\Microsoft\Win32\SafeHandles\X509ExtensionSafeHandles.Unix.cs</Link>

     </Compile>

@@ -390,7 +383,6 @@

     <Compile Include="Internal\Cryptography\Pal.OSX\StorePal.ExportPal.cs" />

     <Compile Include="Internal\Cryptography\Pal.OSX\StorePal.LoaderPal.cs" />

     <Compile Include="Internal\Cryptography\Pal.OSX\X509Pal.cs" />

-    <Compile Include="Internal\Cryptography\Pal.Unix\X500NameEncoder.ManagedDecode.cs" />

   </ItemGroup>

   <ItemGroup Condition=" '$(TargetsUnix)' == 'true'">

     <Compile Include="Internal\Cryptography\Pal.Unix\CertificatePolicy.cs" />

@@ -398,6 +390,7 @@

     <Compile Include="Internal\Cryptography\Pal.Unix\ManagedCertificateFinder.cs" />

     <Compile Include="Internal\Cryptography\Pal.Unix\ManagedX509ExtensionProcessor.cs" />

     <Compile Include="Internal\Cryptography\Pal.Unix\X500NameEncoder.cs" />

+    <Compile Include="Internal\Cryptography\Pal.Unix\X500NameEncoder.ManagedDecode.cs" />

   </ItemGroup>

   <ItemGroup>

     <Reference Include="System.Buffers" />

@@ -417,6 +410,7 @@

     <Reference Include="System.Security.Cryptography.Algorithms" />

     <Reference Include="System.Security.Cryptography.Encoding" />

     <Reference Include="System.Security.Cryptography.Primitives" />

+    <Reference Include="System.Text.Encoding.Extensions" />

     <Reference Include="System.Threading" />

   </ItemGroup>

   <ItemGroup Condition="'$(TargetsWindows)' == 'true'">

diff --git a/src/System.Security.Cryptography.X509Certificates/tests/X500DistinguishedNameTests.cs b/src/System.Security.Cryptography.X509Certificates/tests/X500DistinguishedNameTests.cs

index 027823ffbd..95ac1ed519 100644

--- a/src/System.Security.Cryptography.X509Certificates/tests/X500DistinguishedNameTests.cs

+++ b/src/System.Security.Cryptography.X509Certificates/tests/X500DistinguishedNameTests.cs

@@ -126,6 +126,16 @@ namespace System.Security.Cryptography.X509Certificates.Tests

             Assert.Equal(notQuoted, dn.Decode(X500DistinguishedNameFlags.DoNotUseQuotes));

         }

+        

+        [Theory]

+        [MemberData(nameof(T61Cases))]

+        public static void T61Strings(string expected, string hexEncoded)

+        {

+            byte[] encoded = hexEncoded.HexToByteArray();

+            X500DistinguishedName dn = new X500DistinguishedName(encoded);

+

+            Assert.Equal(expected, dn.Name);

+        }

         [Fact]

         public static void PrintComplexReversed()

@@ -158,6 +168,22 @@ namespace System.Security.Cryptography.X509Certificates.Tests

             Assert.EndsWith(expected, dn.Decode(X500DistinguishedNameFlags.None), StringComparison.Ordinal);

         }

+        [Fact]

+        public static void EdgeCaseEmptyFormat()

+        {

+            X500DistinguishedName dn = new X500DistinguishedName("");

+            Assert.Equal(String.Empty, dn.Format(true));

+            Assert.Equal(String.Empty, dn.Format(false));

+        }

+

+        [Fact]

+        public static void EdgeCaseUseCommaAndNewLines()

+        {

+            const string rname = "C=US, O=\"RSA Data Security, Inc.\", OU=Secure Server Certification Authority";

+            X500DistinguishedName dn = new X500DistinguishedName(rname, X500DistinguishedNameFlags.None);

+            Assert.Equal(rname, dn.Decode(X500DistinguishedNameFlags.UseCommas | X500DistinguishedNameFlags.UseNewLines));

+        }

+

         public static readonly object[][] WhitespaceBeforeCases =

         {

             // Regular space.

@@ -386,6 +412,49 @@ namespace System.Security.Cryptography.X509Certificates.Tests

             },

         };

+        public static readonly object[][] T61Cases =

+        {

+            // https://github.com/dotnet/corefx/issues/27466

+            new object[]

+            {

+                "CN=GrapeCity inc., OU=Tools Development, O=GrapeCity inc., " +

+                "L=Sendai Izumi-ku, S=Miyagi, C=JP",

+                "308186310b3009060355040613024a50310f300d060355040813064d69796167" +

+                "69311830160603550407130f53656e64616920497a756d692d6b753117301506" +

+                "0355040a140e47726170654369747920696e632e311a3018060355040b141154" +

+                "6f6f6c7320446576656c6f706d656e74311730150603550403140e4772617065" +

+                "4369747920696e632e"

+            },

+

+            // Mono test case taken from old bug report

+            new object[]

+            {

+                "SERIALNUMBER=CVR:13471967-UID:121212121212, E=vhm@use.test.dk, " +

+                "CN=Hedeby's M\u00f8belhandel - Salgsafdelingen, " + 

+                "O=Hedeby's M\u00f8belhandel // CVR:13471967, C=DK",

+                "3081B5310B300906035504061302444B312D302B060355040A14244865646562" +

+                "792773204DF862656C68616E64656C202F2F204356523A313334373139363731" +

+                "2F302D060355040314264865646562792773204DF862656C68616E64656C202D" +

+                "2053616C6773616664656C696E67656E311E301C06092A864886F70D01090116" +

+                "0F76686D407573652E746573742E646B312630240603550405131D4356523A31" +

+                "333437313936372D5549443A313231323132313231323132"

+            },

+

+            // Valid UTF-8 string is interpreted as UTF-8

+            new object[]

+            {

+                "C=\u00a2",

+                "300D310B300906035504061402C2A2"

+            },

+

+            // Invalid UTF-8 string with valid UTF-8 sequence is interpreted as ISO 8859-1

+            new object[]

+            {

+                "L=\u00c2\u00a2\u00f8",

+                "300E310C300A06035504071403C2A2F8"

+            },

+        };

+

         private const string MicrosoftDotComSubject =

             "3082010F31133011060B2B0601040182373C02010313025553311B3019060B2B" +