Add tracing to the Linux X509Chain implementation

src/libraries/System.Security.Cryptography/src/System.Security.Cryptography.csproj

@@ -823,6 +823,7 @@
     <Compile Include="System\Security\Cryptography\X509Certificates\OpenSslPkcs12Reader.cs" />
     <Compile Include="System\Security\Cryptography\X509Certificates\OpenSslSingleCertLoader.cs" />
     <Compile Include="System\Security\Cryptography\X509Certificates\OpenSslX509CertificateReader.cs" />
+    <Compile Include="System\Security\Cryptography\X509Certificates\OpenSslX509ChainEventSource.cs" />
     <Compile Include="System\Security\Cryptography\X509Certificates\OpenSslX509ChainProcessor.cs" />
     <Compile Include="System\Security\Cryptography\X509Certificates\OpenSslX509Encoder.cs" />
     <Compile Include="System\Security\Cryptography\X509Certificates\StorePal.OpenSsl.cs" />
@@ -1789,6 +1790,7 @@
     <Reference Include="System.Collections" />
     <Reference Include="System.Collections.Concurrent" />
     <Reference Include="System.Collections.NonGeneric" />
+    <Reference Include="System.Diagnostics.Tracing" />
     <Reference Include="System.Diagnostics.StackTrace" />
     <Reference Include="System.Formats.Asn1" />
     <Reference Include="System.Memory" />

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/ChainPal.OpenSsl.cs

@@ -38,6 +38,50 @@ public static void FlushStores()
             DateTime verificationTime,
             TimeSpan timeout,
             bool disableAia)
+        {
+            if (OpenSslX509ChainEventSource.Log.IsEnabled())
+            {
+                OpenSslX509ChainEventSource.Log.ChainStart();
+            }
+
+            try
+            {
+                return BuildChainCore(
+                    useMachineContext,
+                    cert,
+                    extraStore,
+                    applicationPolicy,
+                    certificatePolicy,
+                    revocationMode,
+                    revocationFlag,
+                    customTrustStore,
+                    trustMode,
+                    verificationTime,
+                    timeout,
+                    disableAia);
+            }
+            finally
+            {
+                if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                {
+                    OpenSslX509ChainEventSource.Log.ChainStop();
+                }
+            }
+        }
+
+        private static IChainPal? BuildChainCore(
+            bool useMachineContext,
+            ICertificatePal cert,
+            X509Certificate2Collection? extraStore,
+            OidCollection? applicationPolicy,
+            OidCollection? certificatePolicy,
+            X509RevocationMode revocationMode,
+            X509RevocationFlag revocationFlag,
+            X509Certificate2Collection? customTrustStore,
+            X509ChainTrustMode trustMode,
+            DateTime verificationTime,
+            TimeSpan timeout,
+            bool disableAia)
         {
             if (timeout == TimeSpan.Zero)
             {
@@ -77,32 +121,59 @@ public static void FlushStores()
 
             Interop.Crypto.X509VerifyStatusCode status = chainPal.FindFirstChain(extraStore);
 
-            if (!OpenSslX509ChainProcessor.IsCompleteChain(status) && !disableAia)
+            if (OpenSslX509ChainEventSource.Log.IsEnabled())
             {
-                List<X509Certificate2>? tmp = null;
-                status = chainPal.FindChainViaAia(ref tmp);
+                OpenSslX509ChainEventSource.Log.FindFirstChainFinished(status);
+            }
 
-                if (tmp != null)
+            if (!OpenSslX509ChainProcessor.IsCompleteChain(status))
+            {
+                if (disableAia)
                 {
-                    if (status == Interop.Crypto.X509VerifyStatusCode.X509_V_OK)
+                    if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                    {
+                        OpenSslX509ChainEventSource.Log.AiaDisabled();
+                    }
+                }
+                else
+                {
+                    List<X509Certificate2>? tmp = null;
+                    status = chainPal.FindChainViaAia(ref tmp);
+
+                    if (OpenSslX509ChainEventSource.Log.IsEnabled())
                     {
-                        SaveIntermediateCertificates(tmp);
+                        OpenSslX509ChainEventSource.Log.FindChainViaAiaFinished(status, tmp?.Count ?? 0);
                     }
 
-                    foreach (X509Certificate2 downloaded in tmp)
+                    if (tmp != null)
                     {
-                        downloaded.Dispose();
+                        if (status == Interop.Crypto.X509VerifyStatusCode.X509_V_OK)
+                        {
+                            SaveIntermediateCertificates(tmp);
+                        }
+
+                        foreach (X509Certificate2 downloaded in tmp)
+                        {
+                            downloaded.Dispose();
+                        }
                     }
                 }
             }
 
-            // In NoCheck+OK then we don't need to build the chain any more, we already
-            // know it's error-free.  So skip straight to finish.
-            if (status != Interop.Crypto.X509VerifyStatusCode.X509_V_OK ||
-                revocationMode != X509RevocationMode.NoCheck)
+            if (revocationMode != X509RevocationMode.NoCheck)
             {
                 if (OpenSslX509ChainProcessor.IsCompleteChain(status))
                 {
+                    if (status != Interop.Crypto.X509VerifyStatusCode.X509_V_OK)
+                    {
+                        if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                        {
+                            OpenSslX509ChainEventSource.Log.UntrustedChainWithRevocation();
+                        }
+
+                        revocationMode = X509RevocationMode.NoCheck;
+                    }
+
                     chainPal.CommitToChain();
                     chainPal.ProcessRevocation(revocationMode, revocationFlag);
                 }
@@ -132,18 +203,34 @@ private static void SaveIntermediateCertificates(List<X509Certificate2> download
                 catch (CryptographicException)
                 {
                     // Saving is opportunistic, just ignore failures
+
+                    if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                    {
+                        OpenSslX509ChainEventSource.Log.CouldNotOpenCAStore();
+                    }
+
                     return;
                 }
 
                 foreach (X509Certificate2 cert in downloadedCerts)
                 {
                     try
                     {
+                        if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                        {
+                            OpenSslX509ChainEventSource.Log.CachingIntermediate(cert);
+                        }
+
                         userIntermediate.Add(cert);
                     }
                     catch
                     {
                         // Saving is opportunistic, just ignore failures
+
+                        if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                        {
+                            OpenSslX509ChainEventSource.Log.CachingIntermediateFailed(cert);
+                        }
                     }
                 }
             }

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/OpenSslCertificateAssetDownloader.cs

@@ -31,6 +31,11 @@ internal static class OpenSslCertificateAssetDownloader
             }
             catch (CryptographicException)
             {
+                if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                {
+                    OpenSslX509ChainEventSource.Log.InvalidDownloadedCertificate();
+                }
+
                 return null;
             }
         }
@@ -70,6 +75,11 @@ internal static class OpenSslCertificateAssetDownloader
                 }
             }
 
+            if (OpenSslX509ChainEventSource.Log.IsEnabled())
+            {
+                OpenSslX509ChainEventSource.Log.InvalidDownloadedCrl();
+            }
+
             return null;
         }
 
@@ -91,26 +101,61 @@ internal static class OpenSslCertificateAssetDownloader
                 // We're not going to report this error to a user, so clear it
                 // (to avoid tainting future exceptions)
                 Interop.Crypto.ErrClearError();
+
+                if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                {
+                    OpenSslX509ChainEventSource.Log.InvalidDownloadedOcsp();
+                }
             }
 
             return resp;
         }
 
         private static byte[]? DownloadAsset(string uri, TimeSpan downloadTimeout)
         {
-            if (s_downloadBytes != null && downloadTimeout > TimeSpan.Zero)
+            if (s_downloadBytes is null)
             {
-                long totalMillis = (long)downloadTimeout.TotalMilliseconds;
-                CancellationTokenSource? cts = totalMillis > int.MaxValue ? null : new CancellationTokenSource((int)totalMillis);
+                if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                {
+                    OpenSslX509ChainEventSource.Log.HttpClientNotAvailable();
+                }
+
+                return null;
+            }
 
-                try
+            if (downloadTimeout <= TimeSpan.Zero)
+            {
+                if (OpenSslX509ChainEventSource.Log.IsEnabled())
                 {
-                    return s_downloadBytes(uri, cts?.Token ?? default);
+                    OpenSslX509ChainEventSource.Log.DownloadTimeExceeded();
                 }
-                catch { }
-                finally
+
+                return null;
+            }
+
+            long totalMillis = (long)downloadTimeout.TotalMilliseconds;
+
+            if (OpenSslX509ChainEventSource.Log.IsEnabled())
+            {
+                OpenSslX509ChainEventSource.Log.AssetDownloadStart(totalMillis, uri);
+            }
+
+            CancellationTokenSource? cts = totalMillis > int.MaxValue ? null : new CancellationTokenSource((int)totalMillis);
+            byte[]? ret = null;
+
+            try
+            {
+                ret = s_downloadBytes(uri, cts?.Token ?? default);
+                return ret;
+            }
+            catch { }
+            finally
+            {
+                cts?.Dispose();
+
+                if (OpenSslX509ChainEventSource.Log.IsEnabled())
                 {
-                    cts?.Dispose();
+                    OpenSslX509ChainEventSource.Log.AssetDownloadStop(ret?.Length ?? 0);
                 }
             }
 
@@ -214,9 +259,19 @@ internal static class OpenSslCertificateAssetDownloader
                         redirections++;
                         if (redirections > MaxRedirections)
                         {
+                            if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                            {
+                                OpenSslX509ChainEventSource.Log.DownloadRedirectsExceeded();
+                            }
+
                             return null;
                         }
 
+                        if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                        {
+                            OpenSslX509ChainEventSource.Log.DownloadRedirected(redirectUri);
+                        }
+
                         // Equivalent of:
                         // requestMessage = new HttpRequestMessage() { RequestUri = redirectUri };
                         // requestMessage.RequestUri = redirectUri;
@@ -284,6 +339,11 @@ internal static class OpenSslCertificateAssetDownloader
 
             if (!IsAllowedScheme(location.Scheme))
             {
+                if (OpenSslX509ChainEventSource.Log.IsEnabled())
+                {
+                    OpenSslX509ChainEventSource.Log.DownloadRedirectNotFollowed(location);
+                }
+
                 return null;
             }