Mark SslProtocols.Tls and SslProtocols.Tls11 as obsolete (#65773)

Fixes #65546

diff --git a/docs/project/list-of-diagnostics.md b/docs/project/list-of-diagnostics.md
index 713ac1f..05085a1 100644 (file)
--- a/docs/project/list-of-diagnostics.md
+++ b/docs/project/list-of-diagnostics.md
@@ -92,6 +92,8 @@ The PR that reveals the implementation of the `<IncludeInternalObsoleteAttribute
 |  __`SYSLIB0035`__ | ComputeCounterSignature without specifying a CmsSigner is obsolete and is not supported. Use the overload that accepts a CmsSigner. |
 |  __`SYSLIB0036`__ | Regex.CompileToAssembly is obsolete and not supported. Use RegexGeneratorAttribute with the regular expression source generator instead. |
 |  __`SYSLIB0037`__ | AssemblyName members HashAlgorithm, ProcessorArchitecture, and VersionCompatibility are obsolete and not supported. |
+|  __`SYSLIB0038`__ | SerializationFormat.Binary is obsolete and should not be used. See https://aka.ms/serializationformat-binary-obsolete for more information. |
+|  __`SYSLIB0039`__ | TLS versions 1.0 and 1.1 have known vulnerabilities and are not recommended. Use a newer TLS version instead, or use SslProtocols.None to defer to OS defaults. |
 
 ## Analyzer Warnings
 

diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs
index 19a3596..cb68d9a 100644 (file)
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs
@@ -99,7 +99,9 @@ internal static partial class Interop
                     // we are using default settings but cipher suites policy says that TLS 1.3
                     // is not compatible with our settings (i.e. we requested no encryption or disabled
                     // all TLS 1.3 cipher suites)
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                     protocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12;
+#pragma warning restore SYSLIB0039
                 }
                 else
                 {

diff --git a/src/libraries/Common/src/System/Net/SecurityProtocol.cs b/src/libraries/Common/src/System/Net/SecurityProtocol.cs
index a8ff9b3..cca3e0d 100644 (file)
--- a/src/libraries/Common/src/System/Net/SecurityProtocol.cs
+++ b/src/libraries/Common/src/System/Net/SecurityProtocol.cs
@@ -11,7 +11,9 @@ namespace System.Net
 #if !NETSTANDARD2_0 && !NETSTANDARD2_1 && !NETFRAMEWORK
             SslProtocols.Tls13 |
 #endif
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12;
+#pragma warning restore SYSLIB0039
 
         public const SslProtocols SystemDefaultSecurityProtocols = SslProtocols.None;
     }

diff --git a/src/libraries/Common/src/System/Obsoletions.cs b/src/libraries/Common/src/System/Obsoletions.cs
index 6330a9f..11f92c8 100644 (file)
--- a/src/libraries/Common/src/System/Obsoletions.cs
+++ b/src/libraries/Common/src/System/Obsoletions.cs
@@ -126,5 +126,8 @@ namespace System
 
         internal const string SystemDataSerializationFormatBinaryMessage = "SerializationFormat.Binary is obsolete and should not be used. See https://aka.ms/serializationformat-binary-obsolete for more information.";
         internal const string SystemDataSerializationFormatBinaryDiagId = "SYSLIB0038";
+
+        internal const string TlsVersion10and11Message = "TLS versions 1.0 and 1.1 have known vulnerabilities and are not recommended. Use a newer TLS version instead, or use SslProtocols.None to defer to OS defaults.";
+        internal const string TlsVersion10and11DiagId = "SYSLIB0039";
     }
 }

diff --git a/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.AcceptAllCerts.cs b/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.AcceptAllCerts.cs
index af36255..4cb7c50 100644 (file)
--- a/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.AcceptAllCerts.cs
+++ b/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.AcceptAllCerts.cs
@@ -36,19 +36,23 @@ namespace System.Net.Http.Functional.Tests
         [Theory]
         [InlineData(SslProtocols.Tls12, false)] // try various protocols to ensure we correctly set versions even when accepting all certs
         [InlineData(SslProtocols.Tls12, true)]
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
         [InlineData(SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls, false)]
         [InlineData(SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls, true)]
 #if !NETFRAMEWORK
         [InlineData(SslProtocols.Tls13 | SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls, false)]
         [InlineData(SslProtocols.Tls13 | SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls, true)]
 #endif
+#pragma warning restore SYSLIB0039
         [InlineData(SslProtocols.None, false)]
         [InlineData(SslProtocols.None, true)]
         public async Task SetDelegate_ConnectionSucceeds(SslProtocols acceptedProtocol, bool requestOnlyThisProtocol)
         {
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             // Overriding flag for the same reason we skip tests on Catalina
             // On OSX 10.13-10.14 we can override this flag to enable the scenario
             requestOnlyThisProtocol |= PlatformDetection.IsOSX && acceptedProtocol == SslProtocols.Tls;
+#pragma warning restore SYSLIB0039
 
             using (HttpClientHandler handler = CreateHttpClientHandler())
             using (HttpClient client = CreateHttpClient(handler))
@@ -65,11 +69,13 @@ namespace System.Net.Http.Functional.Tests
                     // restrictions on minimum TLS/SSL version
                     // We currently know that some platforms like Debian 10 OpenSSL
                     // will by default block < TLS 1.2
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
 #if !NETFRAMEWORK
                     handler.SslProtocols = SslProtocols.Tls13 | SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls;
 #else
                     handler.SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls;
 #endif
+#pragma warning restore SYSLIB0039
                 }
 
                 var options = new LoopbackServer.Options { UseSsl = true, SslProtocols = acceptedProtocol };

diff --git a/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs b/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs
index d6ecb3b..58aaee3 100644 (file)
--- a/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs
+++ b/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.SslProtocols.cs
@@ -36,6 +36,7 @@ namespace System.Net.Http.Functional.Tests
 
         [Theory]
         [InlineData(SslProtocols.None)]
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
         [InlineData(SslProtocols.Tls)]
         [InlineData(SslProtocols.Tls11)]
         [InlineData(SslProtocols.Tls12)]
@@ -50,6 +51,7 @@ namespace System.Net.Http.Functional.Tests
         [InlineData(SslProtocols.Tls | SslProtocols.Tls13)]
         [InlineData(SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12 | SslProtocols.Tls13)]
 #endif
+#pragma warning restore SYSLIB0039
         public void SetGetProtocols_Roundtrips(SslProtocols protocols)
         {
             using (HttpClientHandler handler = CreateHttpClientHandler())
@@ -119,12 +121,14 @@ namespace System.Net.Http.Functional.Tests
                     // We currently know that some platforms like Debian 10 OpenSSL
                     // will by default block < TLS 1.2
 #pragma warning disable 0618 // SSL2/3 are deprecated
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
 #if !NETFRAMEWORK
                     handler.SslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12 | SslProtocols.Tls13;
 #else
                     handler.SslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12 | (SslProtocols)12288;
 #endif
 #pragma warning restore 0618
+#pragma warning restore SYSLIB0039
                 }
 
                 // Use a different SNI for each connection to prevent TLS 1.3 renegotiation issue: https://github.com/dotnet/runtime/issues/47378
@@ -162,6 +166,7 @@ namespace System.Net.Http.Functional.Tests
                 yield return new object[] { SslProtocols.Ssl3, Configuration.Http.SSLv3RemoteServer };
             }
 #pragma warning restore 0618
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             if (PlatformDetection.SupportsTls10)
             {
                 yield return new object[] { SslProtocols.Tls, Configuration.Http.TLSv10RemoteServer };
@@ -171,6 +176,7 @@ namespace System.Net.Http.Functional.Tests
             {
                 yield return new object[] { SslProtocols.Tls11, Configuration.Http.TLSv11RemoteServer };
             }
+#pragma warning restore SYSLIB0039
 
             if (PlatformDetection.SupportsTls12)
             {
@@ -262,16 +268,20 @@ namespace System.Net.Http.Functional.Tests
         [InlineData(SslProtocols.Ssl2, SslProtocols.Tls12)]
         [InlineData(SslProtocols.Ssl3, SslProtocols.Tls12)]
 #pragma warning restore 0618
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
         [InlineData(SslProtocols.Tls11, SslProtocols.Tls)]
         [InlineData(SslProtocols.Tls11 | SslProtocols.Tls12, SslProtocols.Tls)] // Skip this on WinHttpHandler.
         [InlineData(SslProtocols.Tls12, SslProtocols.Tls11)]
         [InlineData(SslProtocols.Tls, SslProtocols.Tls12)]
+#pragma warning restore SYSLIB0039
         public async Task GetAsync_AllowedClientSslVersionDiffersFromServer_ThrowsException(
             SslProtocols allowedClientProtocols, SslProtocols acceptedServerProtocols)
         {
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             if (IsWinHttpHandler &&
                 allowedClientProtocols == (SslProtocols.Tls11 | SslProtocols.Tls12) &&
                 acceptedServerProtocols == SslProtocols.Tls)
+#pragma warning restore SYSLIB0039
             {
                 // Native WinHTTP sometimes uses multiple TCP connections to try other TLS protocols when
                 // getting TLS protocol failures as part of its TLS fallback algorithm. The loopback server

diff --git a/src/libraries/Common/tests/System/Net/Http/LoopbackServer.cs b/src/libraries/Common/tests/System/Net/Http/LoopbackServer.cs
index 70ddfcf..51445ab 100644 (file)
--- a/src/libraries/Common/tests/System/Net/Http/LoopbackServer.cs
+++ b/src/libraries/Common/tests/System/Net/Http/LoopbackServer.cs
@@ -436,7 +436,9 @@ namespace System.Net.Test.Common
 #if !NETSTANDARD2_0 && !NETFRAMEWORK
                 SslProtocols.Tls13 |
 #endif
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                 SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12;
+#pragma warning restore SYSLIB0039
             }
         }
 

diff --git a/src/libraries/Common/tests/System/Net/SslProtocolSupport.cs b/src/libraries/Common/tests/System/Net/SslProtocolSupport.cs
index 302021b..0c1418f 100644 (file)
--- a/src/libraries/Common/tests/System/Net/SslProtocolSupport.cs
+++ b/src/libraries/Common/tests/System/Net/SslProtocolSupport.cs
@@ -14,9 +14,11 @@ namespace System.Net.Test.Common
 #if !NETSTANDARD2_0
             SslProtocols.Tls13 |
 #endif
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls;
 
         public const SslProtocols NonTls13Protocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12;
+#pragma warning restore SYSLIB0039
 
         public static SslProtocols SupportedSslProtocols
         {
@@ -29,6 +31,7 @@ namespace System.Net.Test.Common
                     supported |= SslProtocols.Ssl3;
                 }
 #pragma warning restore 0618
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                 if (PlatformDetection.SupportsTls10)
                 {
                     supported |= SslProtocols.Tls;
@@ -38,6 +41,7 @@ namespace System.Net.Test.Common
                 {
                     supported |= SslProtocols.Tls11;
                 }
+#pragma warning restore SYSLIB0039
 
                 if (PlatformDetection.SupportsTls12)
                 {

diff --git a/src/libraries/System.Net.Http.WinHttpHandler/src/System/Net/Http/WinHttpHandler.cs b/src/libraries/System.Net.Http.WinHttpHandler/src/System/Net/Http/WinHttpHandler.cs
index d6c46b1..78acec6 100644 (file)
--- a/src/libraries/System.Net.Http.WinHttpHandler/src/System/Net/Http/WinHttpHandler.cs
+++ b/src/libraries/System.Net.Http.WinHttpHandler/src/System/Net/Http/WinHttpHandler.cs
@@ -1188,6 +1188,7 @@ namespace System.Net.Http
             }
 #pragma warning restore 0618
 
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             if ((sslProtocols & SslProtocols.Tls) != 0)
             {
                 optionData |= Interop.WinHttp.WINHTTP_FLAG_SECURE_PROTOCOL_TLS1;
@@ -1197,6 +1198,7 @@ namespace System.Net.Http
             {
                 optionData |= Interop.WinHttp.WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1;
             }
+#pragma warning restore SYSLIB0039
 
             if ((sslProtocols & SslProtocols.Tls12) != 0)
             {

diff --git a/src/libraries/System.Net.Http.WinHttpHandler/tests/UnitTests/WinHttpHandlerTest.cs b/src/libraries/System.Net.Http.WinHttpHandler/tests/UnitTests/WinHttpHandlerTest.cs
index 2cdd62b..8f03d72 100644 (file)
--- a/src/libraries/System.Net.Http.WinHttpHandler/tests/UnitTests/WinHttpHandlerTest.cs
+++ b/src/libraries/System.Net.Http.WinHttpHandler/tests/UnitTests/WinHttpHandlerTest.cs
@@ -562,7 +562,9 @@ namespace System.Net.Http.WinHttpHandlerUnitTests
 
         [Theory]
         [InlineData(
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12,
+#pragma warning restore SYSLIB0039
             Interop.WinHttp.WINHTTP_FLAG_SECURE_PROTOCOL_TLS1 |
             Interop.WinHttp.WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1 |
             Interop.WinHttp.WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2)]

diff --git a/src/libraries/System.Net.Primitives/ref/System.Net.Primitives.cs b/src/libraries/System.Net.Primitives/ref/System.Net.Primitives.cs
index ebdec66..d321700 100644 (file)
--- a/src/libraries/System.Net.Primitives/ref/System.Net.Primitives.cs
+++ b/src/libraries/System.Net.Primitives/ref/System.Net.Primitives.cs
@@ -516,9 +516,11 @@ namespace System.Security.Authentication
         Ssl2 = 12,
         [System.ObsoleteAttribute("SslProtocols.Ssl3 has been deprecated and is not supported.")]
         Ssl3 = 48,
+        [System.ObsoleteAttribute("TLS versions 1.0 and 1.1 have known vulnerabilities and are not recommended. Use a newer TLS version instead, or use SslProtocols.None to defer to OS defaults.", DiagnosticId = "SYSLIB0039", UrlFormat = "https://aka.ms/dotnet-warnings/{0}")]
         Tls = 192,
         [System.ObsoleteAttribute("SslProtocols.Default has been deprecated and is not supported.")]
         Default = 240,
+        [System.ObsoleteAttribute("TLS versions 1.0 and 1.1 have known vulnerabilities and are not recommended. Use a newer TLS version instead, or use SslProtocols.None to defer to OS defaults.", DiagnosticId = "SYSLIB0039", UrlFormat = "https://aka.ms/dotnet-warnings/{0}")]
         Tls11 = 768,
         Tls12 = 3072,
         Tls13 = 12288,
@@ -528,8 +530,8 @@ namespace System.Security.Authentication.ExtendedProtection
 {
     public abstract partial class ChannelBinding : Microsoft.Win32.SafeHandles.SafeHandleZeroOrMinusOneIsInvalid
     {
-        protected ChannelBinding() : base (default(bool)) { }
-        protected ChannelBinding(bool ownsHandle) : base (default(bool)) { }
+        protected ChannelBinding() : base(default(bool)) { }
+        protected ChannelBinding(bool ownsHandle) : base(default(bool)) { }
         public abstract int Size { get; }
     }
     public enum ChannelBindingKind

diff --git a/src/libraries/System.Net.Primitives/src/System.Net.Primitives.csproj b/src/libraries/System.Net.Primitives/src/System.Net.Primitives.csproj
index 3c17ba5..1227e13 100644 (file)
--- a/src/libraries/System.Net.Primitives/src/System.Net.Primitives.csproj
+++ b/src/libraries/System.Net.Primitives/src/System.Net.Primitives.csproj
@@ -86,6 +86,9 @@
              Link="Common\Interop\Windows\SChannel\Interop.SchProtocols.cs" />
     <Compile Include="$(CommonPath)Interop\Windows\WinSock\Interop.ErrorCodes.cs"
              Link="Common\Interop\Windows\WinSock\Interop.ErrorCodes.cs" />
+    <!-- Common -->
+    <Compile Include="$(CommonPath)System\Obsoletions.cs" 
+             Link="Common\System\Obsoletions.cs" />
   </ItemGroup>
   <ItemGroup Condition="'$(TargetPlatformIdentifier)' == 'windows'">
     <Compile Include="System\Net\SocketException.Windows.cs" />

diff --git a/src/libraries/System.Net.Primitives/src/System/Net/SecureProtocols/SslEnumTypes.cs b/src/libraries/System.Net.Primitives/src/System/Net/SecureProtocols/SslEnumTypes.cs
index db0fd62..e5c4e10 100644 (file)
--- a/src/libraries/System.Net.Primitives/src/System/Net/SecureProtocols/SslEnumTypes.cs
+++ b/src/libraries/System.Net.Primitives/src/System/Net/SecureProtocols/SslEnumTypes.cs
@@ -10,12 +10,17 @@ namespace System.Security.Authentication
     public enum SslProtocols
     {
         None = 0,
+        [System.ObsoleteAttribute("SslProtocols.Ssl2 has been deprecated and is not supported.")]
         Ssl2 = Interop.SChannel.SP_PROT_SSL2,
+        [System.ObsoleteAttribute("SslProtocols.Ssl3 has been deprecated and is not supported.")]
         Ssl3 = Interop.SChannel.SP_PROT_SSL3,
+        [System.ObsoleteAttribute(Obsoletions.TlsVersion10and11Message, DiagnosticId = Obsoletions.TlsVersion10and11DiagId, UrlFormat = Obsoletions.SharedUrlFormat)]
         Tls = Interop.SChannel.SP_PROT_TLS1_0,
+        [System.ObsoleteAttribute(Obsoletions.TlsVersion10and11Message, DiagnosticId = Obsoletions.TlsVersion10and11DiagId, UrlFormat = Obsoletions.SharedUrlFormat)]
         Tls11 = Interop.SChannel.SP_PROT_TLS1_1,
         Tls12 = Interop.SChannel.SP_PROT_TLS1_2,
         Tls13 = Interop.SChannel.SP_PROT_TLS1_3,
+        [System.ObsoleteAttribute("SslProtocols.Default has been deprecated and is not supported.")]
         Default = Ssl3 | Tls
     }
 

diff --git a/src/libraries/System.Net.Security/src/System.Net.Security.csproj b/src/libraries/System.Net.Security/src/System.Net.Security.csproj
index b332462..2fd4b29 100644 (file)
--- a/src/libraries/System.Net.Security/src/System.Net.Security.csproj
+++ b/src/libraries/System.Net.Security/src/System.Net.Security.csproj
@@ -94,6 +94,8 @@
              Link="Common\System\Net\SecurityStatusPal.cs" />
     <Compile Include="$(CommonPath)System\HexConverter.cs"
              Link="Common\System\HexConverter.cs" />
+    <Compile Include="$(CommonPath)System\Obsoletions.cs" 
+             Link="Common\System\Obsoletions.cs" />
   </ItemGroup>
   <!-- This file depends on IANA registry. We do not want anyone's build to break after the update -->
   <!-- or if they don't have internet connection - explicit opt-in required -->

diff --git a/src/libraries/System.Net.Security/src/System/Net/Security/NetSecurityTelemetry.cs b/src/libraries/System.Net.Security/src/System/Net/Security/NetSecurityTelemetry.cs
index eaeb602..5c896b6 100644 (file)
--- a/src/libraries/System.Net.Security/src/System/Net/Security/NetSecurityTelemetry.cs
+++ b/src/libraries/System.Net.Security/src/System/Net/Security/NetSecurityTelemetry.cs
@@ -179,6 +179,7 @@ namespace System.Net.Security
 
             switch (protocol)
             {
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                 case SslProtocols.Tls:
                     protocolSessionsOpen = ref _sessionsOpenTls10;
                     handshakeDurationCounter = _handshakeDurationTls10Counter;
@@ -188,6 +189,7 @@ namespace System.Net.Security
                     protocolSessionsOpen = ref _sessionsOpenTls11;
                     handshakeDurationCounter = _handshakeDurationTls11Counter;
                     break;
+#pragma warning restore SYSLIB0039
 
                 case SslProtocols.Tls12:
                     protocolSessionsOpen = ref _sessionsOpenTls12;
@@ -220,6 +222,7 @@ namespace System.Net.Security
 
             switch (protocol)
             {
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                 case SslProtocols.Tls:
                     count = Interlocked.Decrement(ref _sessionsOpenTls10);
                     break;
@@ -227,6 +230,7 @@ namespace System.Net.Security
                 case SslProtocols.Tls11:
                     count = Interlocked.Decrement(ref _sessionsOpenTls11);
                     break;
+#pragma warning restore SYSLIB0039
 
                 case SslProtocols.Tls12:
                     count = Interlocked.Decrement(ref _sessionsOpenTls12);

diff --git a/src/libraries/System.Net.Security/src/System/Net/Security/Pal.Android/SafeDeleteSslContext.cs b/src/libraries/System.Net.Security/src/System/Net/Security/Pal.Android/SafeDeleteSslContext.cs
index 62f1559..a0e8fdc 100644 (file)
--- a/src/libraries/System.Net.Security/src/System/Net/Security/Pal.Android/SafeDeleteSslContext.cs
+++ b/src/libraries/System.Net.Security/src/System/Net/Security/Pal.Android/SafeDeleteSslContext.cs
@@ -22,8 +22,10 @@ namespace System.Net
         private const int InitialBufferSize = 2048;
         private static readonly SslProtocols[] s_orderedSslProtocols = new SslProtocols[]
         {
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             SslProtocols.Tls,
             SslProtocols.Tls11,
+#pragma warning restore SYSLIB0039
             SslProtocols.Tls12,
             SslProtocols.Tls13,
         };
@@ -224,7 +226,7 @@ namespace System.Net
             Interop.AndroidCrypto.SSLStreamInitialize(handle, isServer, readCallback, writeCallback, InitialBufferSize);
 
             if (credential.Protocols != SslProtocols.None)
-            {;
+            {
                 SslProtocols protocolsToEnable = credential.Protocols & s_supportedSslProtocols.Value;
                 if (protocolsToEnable == 0)
                 {

diff --git a/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs b/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
index 660a550..85ce81d 100644 (file)
--- a/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
+++ b/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
@@ -339,8 +339,10 @@ namespace System.Net
             SslProtocols.Ssl2,
             SslProtocols.Ssl3,
 #pragma warning restore 0618
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             SslProtocols.Tls,
             SslProtocols.Tls11,
+#pragma warning restore SYSLIB0039
             SslProtocols.Tls12
         };
 

diff --git a/src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.Android.cs b/src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.Android.cs
index 46024d3..d8effb9 100644 (file)
--- a/src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.Android.cs
+++ b/src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.Android.cs
@@ -17,8 +17,10 @@ namespace System.Net.Security
 #pragma warning disable 0618 // 'SslProtocols.Ssl3' is obsolete
                 "SSLv3" => SslProtocols.Ssl3,
 #pragma warning restore
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                 "TLSv1" => SslProtocols.Tls,
                 "TLSv1.1" => SslProtocols.Tls11,
+#pragma warning restore SYSLIB0039
                 "TLSv1.2" => SslProtocols.Tls12,
                 "TLSv1.3" => SslProtocols.Tls13,
                 _ => SslProtocols.None,

diff --git a/src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.Linux.cs b/src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.Linux.cs
index 4bff0b9..6621d88 100644 (file)
--- a/src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.Linux.cs
+++ b/src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.Linux.cs
@@ -48,6 +48,7 @@ namespace System.Net.Security
                 {
                     if (b[5] == '\0')
                     {
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                         return SslProtocols.Tls;
                     }
                     else if (b[5] == '.' && b[6] != '\0' && b[7] == '\0')
@@ -55,6 +56,7 @@ namespace System.Net.Security
                         switch (b[6])
                         {
                             case (byte)'1': return SslProtocols.Tls11;
+#pragma warning restore SYSLIB0039
                             case (byte)'2': return SslProtocols.Tls12;
                             case (byte)'3': return SslProtocols.Tls13;
                         }

diff --git a/src/libraries/System.Net.Security/src/System/Net/Security/SslStream.cs b/src/libraries/System.Net.Security/src/System/Net/Security/SslStream.cs
index 4879d17..8998afb 100644 (file)
--- a/src/libraries/System.Net.Security/src/System/Net/Security/SslStream.cs
+++ b/src/libraries/System.Net.Security/src/System/Net/Security/SslStream.cs
@@ -455,8 +455,8 @@ namespace System.Net.Security
         {
             SslClientAuthenticationOptions options = new SslClientAuthenticationOptions()
             {
-                TargetHost =  targetHost,
-                ClientCertificates =  clientCertificates,
+                TargetHost = targetHost,
+                ClientCertificates = clientCertificates,
                 EnabledSslProtocols = enabledSslProtocols,
                 CertificateRevocationCheckMode = checkCertificateRevocation ? X509RevocationMode.Online : X509RevocationMode.NoCheck,
                 EncryptionPolicy = _encryptionPolicy,
@@ -600,6 +600,7 @@ namespace System.Net.Security
             }
 #pragma warning restore
 
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             if ((proto & SslProtocols.Tls) != 0)
             {
                 ret |= SslProtocols.Tls;
@@ -609,6 +610,7 @@ namespace System.Net.Security
             {
                 ret |= SslProtocols.Tls11;
             }
+#pragma warning restore SYSLIB0039
 
             if ((proto & SslProtocols.Tls12) != 0)
             {

diff --git a/src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs b/src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs
index 8f5b5ed..f95029a 100644 (file)
--- a/src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs
+++ b/src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs
@@ -207,7 +207,7 @@ namespace System.Net.Security
         {
             if (frame.Length < 5 || frame[1] < 3)
             {
-                return - 1;
+                return -1;
             }
 
             return ((frame[3] << 8) | frame[4]) + HeaderSize;
@@ -256,7 +256,9 @@ namespace System.Net.Security
             // Check if we have full frame.
             bool isComplete = frame.Length >= HeaderSize + info.Header.Length;
 
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             if (((int)info.Header.Version >= (int)SslProtocols.Tls) &&
+#pragma warning restore SYSLIB0039
                 (info.HandshakeType == TlsHandshakeType.ClientHello || info.HandshakeType == TlsHandshakeType.ServerHello))
             {
                 if (!TryParseHelloFrame(frame.Slice(HeaderSize), ref info, options, callback))
@@ -300,8 +302,10 @@ namespace System.Net.Security
             {
                 SslProtocols.Tls13 => s_protocolMismatch13,
                 SslProtocols.Tls12 => s_protocolMismatch12,
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                 SslProtocols.Tls11 => s_protocolMismatch11,
                 SslProtocols.Tls => s_protocolMismatch10,
+#pragma warning restore SYSLIB0039
 #pragma warning disable 0618
                 SslProtocols.Ssl3 => s_protocolMismatch30,
 #pragma warning restore 0618
@@ -314,7 +318,9 @@ namespace System.Net.Security
             {
                 return CreateProtocolVersionAlert(version);
             }
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             else if ((int)version > (int)SslProtocols.Tls)
+#pragma warning restore SYSLIB0039
             {
                 // Create TLS1.2 alert
                 byte[] buffer = new byte[] { (byte)TlsContentType.Alert, 3, 3, 0, 2, 2, (byte)reason };
@@ -323,12 +329,14 @@ namespace System.Net.Security
                     case SslProtocols.Tls13:
                         buffer[2] = 4;
                         break;
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                     case SslProtocols.Tls11:
                         buffer[2] = 2;
                         break;
                     case SslProtocols.Tls:
                         buffer[2] = 1;
                         break;
+#pragma warning restore SYSLIB0039
                 }
 
                 return buffer;
@@ -703,8 +711,10 @@ namespace System.Net.Security
             {
                 4 => SslProtocols.Tls13,
                 3 => SslProtocols.Tls12,
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                 2 => SslProtocols.Tls11,
                 1 => SslProtocols.Tls,
+#pragma warning restore SYSLIB0039
 #pragma warning disable 0618
                 0 => SslProtocols.Ssl3,
 #pragma warning restore 0618

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/ClientAsyncAuthenticateTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/ClientAsyncAuthenticateTest.cs
index fae4ac3..19517cf 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/ClientAsyncAuthenticateTest.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/ClientAsyncAuthenticateTest.cs
@@ -42,7 +42,9 @@ namespace System.Net.Security.Tests
             await Assert.ThrowsAsync<AuthenticationException>(
                 () => ClientAsyncSslHelper(
                     EncryptionPolicy.NoEncryption,
-                    SslProtocolSupport.DefaultSslProtocols, SslProtocols.Tls | SslProtocols.Tls11 |  SslProtocols.Tls12));
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
+                    SslProtocolSupport.DefaultSslProtocols, SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12));
+#pragma warning restore SYSLIB0039
         }
 
         [Theory]
@@ -95,14 +97,16 @@ namespace System.Net.Security.Tests
             var supportedProtocols = new SslProtocolSupport.SupportedSslProtocolsTestData();
 
             foreach (var serverProtocols in supportedProtocols)
-            foreach (var clientProtocols in supportedProtocols)
             {
-                SslProtocols serverProtocol = (SslProtocols)serverProtocols[0];
-                SslProtocols clientProtocol = (SslProtocols)clientProtocols[0];
-
-                if (clientProtocol != serverProtocol)
+                foreach (var clientProtocols in supportedProtocols)
                 {
-                    yield return new object[] { clientProtocol, serverProtocol, typeof(AuthenticationException) };
+                    SslProtocols serverProtocol = (SslProtocols)serverProtocols[0];
+                    SslProtocols clientProtocol = (SslProtocols)clientProtocols[0];
+
+                    if (clientProtocol != serverProtocol)
+                    {
+                        yield return new object[] { clientProtocol, serverProtocol, typeof(AuthenticationException) };
+                    }
                 }
             }
         }

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/DummyTcpServer.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/DummyTcpServer.cs
index 16aea4f..148a613 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/DummyTcpServer.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/DummyTcpServer.cs
@@ -25,7 +25,9 @@ namespace System.Net.Security.Tests
         private VerboseTestLogging _log;
         private TcpListener _listener;
         private bool _useSsl;
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
         private SslProtocols _sslProtocols = SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls;
+#pragma warning restore SYSLIB0039
         private EncryptionPolicy _sslEncryptionPolicy;
         private IPEndPoint _remoteEndPoint;
         private DummyTcpServerReceiveCallback _receiveCallback;

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/ServerAllowNoEncryptionTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/ServerAllowNoEncryptionTest.cs
index f54ba5c..d52d4ae 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/ServerAllowNoEncryptionTest.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/ServerAllowNoEncryptionTest.cs
@@ -82,8 +82,10 @@ namespace System.Net.Security.Tests
 
                 using (var sslStream = new SslStream(client.GetStream(), false, AllowAnyServerCertificate, null, EncryptionPolicy.NoEncryption))
                 {
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                     // null encryption is not permitted with Tls13
-                    await sslStream.AuthenticateAsClientAsync("localhost", null, SslProtocols.Tls | SslProtocols.Tls11 |  SslProtocols.Tls12, false);
+                    await sslStream.AuthenticateAsClientAsync("localhost", null, SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12, false);
+#pragma warning restore SYSLIB0039
                     _log.WriteLine("Client authenticated to server({0}) with encryption cipher: {1} {2}-bit strength",
                         serverAllowNoEncryption.RemoteEndPoint, sslStream.CipherAlgorithm, sslStream.CipherStrength);
 

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/ServerAsyncAuthenticateTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/ServerAsyncAuthenticateTest.cs
index ef7eb8f..7dd52bd 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/ServerAsyncAuthenticateTest.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/ServerAsyncAuthenticateTest.cs
@@ -103,7 +103,9 @@ namespace System.Net.Security.Tests
         public async Task ServerAsyncAuthenticate_SniSetVersion_Success(SslProtocols version)
         {
             var serverOptions = new SslServerAuthenticationOptions() { ServerCertificate = _serverCertificate, EnabledSslProtocols = version };
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             var clientOptions = new SslClientAuthenticationOptions() { TargetHost = _serverCertificate.GetNameInfo(X509NameType.SimpleName, forIssuer: false), EnabledSslProtocols = SslProtocols.Tls11 | SslProtocols.Tls12 };
+#pragma warning restore SYSLIB0039
             clientOptions.RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true;
 
             (SslStream client, SslStream server) = TestHelper.GetConnectedSslStreams();
@@ -326,14 +328,16 @@ namespace System.Net.Security.Tests
             var supportedProtocols = new SslProtocolSupport.SupportedSslProtocolsTestData();
 
             foreach (var serverProtocols in supportedProtocols)
-            foreach (var clientProtocols in supportedProtocols)
             {
-                SslProtocols serverProtocol = (SslProtocols)serverProtocols[0];
-                SslProtocols clientProtocol = (SslProtocols)clientProtocols[0];
-
-                if (clientProtocol != serverProtocol)
+                foreach (var clientProtocols in supportedProtocols)
                 {
-                    yield return new object[] { clientProtocol, serverProtocol, typeof(AuthenticationException) };
+                    SslProtocols serverProtocol = (SslProtocols)serverProtocols[0];
+                    SslProtocols clientProtocol = (SslProtocols)clientProtocols[0];
+
+                    if (clientProtocol != serverProtocol)
+                    {
+                        yield return new object[] { clientProtocol, serverProtocol, typeof(AuthenticationException) };
+                    }
                 }
             }
         }
@@ -342,7 +346,9 @@ namespace System.Net.Security.Tests
         {
             if (PlatformDetection.SupportsTls11)
             {
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                 yield return new object[] { SslProtocols.Tls11 };
+#pragma warning restore SYSLIB0039
             }
 
             if (PlatformDetection.SupportsTls12)
@@ -370,7 +376,8 @@ namespace System.Net.Security.Tests
             using (SslStream sslClientStream = new SslStream(
                 clientStream,
                 false,
-                delegate {
+                delegate
+                {
                     // Allow any certificate from the server.
                     // Note that simply ignoring exceptions from AuthenticateAsClientAsync() is not enough
                     // because in Mono, certificate validation is performed during the handshake and a failure
@@ -383,7 +390,7 @@ namespace System.Net.Security.Tests
                 string serverName = TestHelper.GetTestSNIName(nameof(ServerAsyncSslHelper), clientSslProtocols, serverSslProtocols);
 
                 _log.WriteLine("Connected on {0} {1} ({2} {3})", clientStream.Socket.LocalEndPoint, clientStream.Socket.RemoteEndPoint, clientStream.Socket.Handle, serverStream.Socket.Handle);
-                _log.WriteLine("client SslStream#{0} server SslStream#{1}", sslClientStream.GetHashCode(),  sslServerStream.GetHashCode());
+                _log.WriteLine("client SslStream#{0} server SslStream#{1}", sslClientStream.GetHashCode(), sslServerStream.GetHashCode());
 
                 _logVerbose.WriteLine("ServerAsyncAuthenticateTest.AuthenticateAsClientAsync start.");
                 Task clientAuthentication = sslClientStream.AuthenticateAsClientAsync(

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/ServerNoEncryptionTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/ServerNoEncryptionTest.cs
index 6d43dc8..79e5466 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/ServerNoEncryptionTest.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/ServerNoEncryptionTest.cs
@@ -59,7 +59,9 @@ namespace System.Net.Security.Tests
 
                 using (var sslStream = new SslStream(client.GetStream(), false, AllowAnyServerCertificate, null, EncryptionPolicy.AllowNoEncryption))
                 {
-                    await sslStream.AuthenticateAsClientAsync("localhost", null, SslProtocols.Tls | SslProtocols.Tls11 |  SslProtocols.Tls12, false);
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
+                    await sslStream.AuthenticateAsClientAsync("localhost", null, SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12, false);
+#pragma warning restore SYSLIB0039
 
                     _log.WriteLine("Client authenticated to server({0}) with encryption cipher: {1} {2}-bit strength",
                         serverNoEncryption.RemoteEndPoint, sslStream.CipherAlgorithm, sslStream.CipherStrength);
@@ -84,8 +86,10 @@ namespace System.Net.Security.Tests
                 {
                     if (SupportsNullEncryption)
                     {
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                         // null encryption is not permitted with Tls13
-                        await sslStream.AuthenticateAsClientAsync("localhost", null, SslProtocols.Tls | SslProtocols.Tls11 |  SslProtocols.Tls12, false);
+                        await sslStream.AuthenticateAsClientAsync("localhost", null, SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12, false);
+#pragma warning restore SYSLIB0039
                         _log.WriteLine("Client authenticated to server({0}) with encryption cipher: {1} {2}-bit strength",
                             serverNoEncryption.RemoteEndPoint, sslStream.CipherAlgorithm, sslStream.CipherStrength);
 

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/ServerRequireEncryptionTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/ServerRequireEncryptionTest.cs
index a407601..6dbb32d 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/ServerRequireEncryptionTest.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/ServerRequireEncryptionTest.cs
@@ -82,7 +82,9 @@ namespace System.Net.Security.Tests
                 using (var sslStream = new SslStream(client.GetStream(), false, AllowAnyServerCertificate, null, EncryptionPolicy.NoEncryption))
                 {
                     await Assert.ThrowsAsync(TestConfiguration.SupportsHandshakeAlerts ? typeof(AuthenticationException) : typeof(IOException), () =>
-                        sslStream.AuthenticateAsClientAsync("localhost", null, SslProtocols.Tls | SslProtocols.Tls11 |  SslProtocols.Tls12, false));
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
+                        sslStream.AuthenticateAsClientAsync("localhost", null, SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12, false));
+#pragma warning restore SYSLIB0039
                 }
             }
         }

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslAuthenticationOptionsTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslAuthenticationOptionsTest.cs
index f7e7b61..0980d95 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/SslAuthenticationOptionsTest.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/SslAuthenticationOptionsTest.cs
@@ -40,7 +40,9 @@ namespace System.Net.Security.Tests
                 List<SslApplicationProtocol> serverAppProtocols = new List<SslApplicationProtocol> { SslApplicationProtocol.Http11, SslApplicationProtocol.Http2 };
                 X509RevocationMode serverRevocation = X509RevocationMode.NoCheck;
                 bool serverCertRequired = false;
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                 SslProtocols serverSslProtocols = SslProtocols.Tls11 | SslProtocols.Tls12;
+#pragma warning restore SYSLIB0039
                 EncryptionPolicy serverEncryption = EncryptionPolicy.AllowNoEncryption;
                 RemoteCertificateValidationCallback serverRemoteCallback = new RemoteCertificateValidationCallback(delegate { return true; });
                 SslStreamCertificateContext certificateContext = SslStreamCertificateContext.Create(serverCert, null, false);

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamConformanceTests.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamConformanceTests.cs
index d2caf19..17cf391 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamConformanceTests.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamConformanceTests.cs
@@ -66,7 +66,9 @@ namespace System.Net.Security.Tests
     [ConditionalClass(typeof(PlatformDetection), nameof(PlatformDetection.SupportsTls11))]
     public sealed class SslStreamTls11NetworkConformanceTests : SslStreamDefaultNetworkConformanceTests
     {
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
         protected override SslProtocols GetSslProtocols() => SslProtocols.Tls11;
+#pragma warning restore SYSLIB0039
     }
 
     [ConditionalClass(typeof(PlatformDetection), nameof(PlatformDetection.SupportsTls12))]

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNegotiatedCipherSuiteTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNegotiatedCipherSuiteTest.cs
index 32a1546..e276aeb 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNegotiatedCipherSuiteTest.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNegotiatedCipherSuiteTest.cs
@@ -20,10 +20,12 @@ namespace System.Net.Security.Tests
     public class NegotiatedCipherSuiteTest
     {
 #pragma warning disable CS0618 // Ssl2 and Ssl3 are obsolete
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
         public const SslProtocols AllProtocols =
             SslProtocols.Ssl2 | SslProtocols.Ssl3 |
             SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12 | SslProtocols.Tls13;
 #pragma warning restore CS0618
+#pragma warning restore SYSLIB0039
 
         public const SslProtocols NonTls13Protocols = AllProtocols & (~SslProtocols.Tls13);
 
@@ -41,8 +43,10 @@ namespace System.Net.Security.Tests
         private static Dictionary<SslProtocols, HashSet<TlsCipherSuite>> s_protocolCipherSuiteLookup = new Dictionary<SslProtocols, HashSet<TlsCipherSuite>>()
         {
             { SslProtocols.Tls12, s_tls12CipherSuiteLookup },
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             { SslProtocols.Tls11, s_tls10And11CipherSuiteLookup },
             { SslProtocols.Tls, s_tls10And11CipherSuiteLookup },
+#pragma warning restore SYSLIB0039
         };
 
         private static Lazy<bool> s_cipherSuitePolicySupported = new Lazy<bool>(() =>
@@ -81,8 +85,10 @@ namespace System.Net.Security.Tests
         }
 
         [Theory]
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
         [InlineData(SslProtocols.Tls)]
         [InlineData(SslProtocols.Tls11)]
+#pragma warning restore SYSLIB0039
         [InlineData(SslProtocols.Tls12)]
         public void NegotiatedCipherSuite_SslProtocolIsLowerThanTls13_ShouldMatchTheProtocol(SslProtocols protocol)
         {

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
index 44dbc87..6cd21d5 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
@@ -64,7 +64,9 @@ namespace System.Net.Security.Tests
             if (PlatformDetection.SupportsTls12 && (PlatformDetection.SupportsTls10 || PlatformDetection.SupportsTls11))
             {
                 // OpenSSL 1.0 where new is Tls12
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                 clientProtocol = SslProtocols.Tls | SslProtocols.Tls11;
+#pragma warning restore SYSLIB0039
                 serverProtocol = SslProtocols.Tls12;
             }
             else if (PlatformDetection.SupportsTls12 && PlatformDetection.SupportsTls13)
@@ -193,7 +195,9 @@ namespace System.Net.Security.Tests
                 SslClientAuthenticationOptions clientOptions = new SslClientAuthenticationOptions()
                 {
                     TargetHost = Guid.NewGuid().ToString("N"),
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                     EnabledSslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12,
+#pragma warning restore SYSLIB0039
                 };
                 clientOptions.RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true;
                 clientOptions.LocalCertificateSelectionCallback = (sender, targetHost, localCertificates, remoteCertificate, acceptableIssuers) =>
@@ -267,7 +271,9 @@ namespace System.Net.Security.Tests
                 SslClientAuthenticationOptions clientOptions = new SslClientAuthenticationOptions()
                 {
                     TargetHost = Guid.NewGuid().ToString("N"),
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                     EnabledSslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12,
+#pragma warning restore SYSLIB0039
                 };
                 clientOptions.RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true;
                 clientOptions.LocalCertificateSelectionCallback = (sender, targetHost, localCertificates, remoteCertificate, acceptableIssuers) =>
@@ -275,8 +281,11 @@ namespace System.Net.Security.Tests
                     return sendClientCertificate ? clientCertificate : null;
                 };
 
-                SslServerAuthenticationOptions serverOptions = new SslServerAuthenticationOptions() { ServerCertificate = serverCertificate,
-                                                                                                      AllowRenegotiation = false  };
+                SslServerAuthenticationOptions serverOptions = new SslServerAuthenticationOptions()
+                {
+                    ServerCertificate = serverCertificate,
+                    AllowRenegotiation = false
+                };
                 serverOptions.RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) =>
                 {
                     if (negotiateClientCertificateCalled && sendClientCertificate)
@@ -336,7 +345,9 @@ namespace System.Net.Security.Tests
                 SslClientAuthenticationOptions clientOptions = new SslClientAuthenticationOptions()
                 {
                     TargetHost = Guid.NewGuid().ToString("N"),
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                     EnabledSslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12,
+#pragma warning restore SYSLIB0039
                 };
                 clientOptions.RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true;
 
@@ -353,7 +364,7 @@ namespace System.Net.Security.Tests
                 // Send application data instead of Client hello.
                 await client.WriteAsync(new byte[500], cts.Token);
                 // Fail as it is not allowed to receive non handshake frames during handshake.
-                await Assert.ThrowsAsync<InvalidOperationException>(()=> t);
+                await Assert.ThrowsAsync<InvalidOperationException>(() => t);
             }
         }
 
@@ -378,7 +389,9 @@ namespace System.Net.Security.Tests
                 SslClientAuthenticationOptions clientOptions = new SslClientAuthenticationOptions()
                 {
                     TargetHost = Guid.NewGuid().ToString("N"),
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                     EnabledSslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12,
+#pragma warning restore SYSLIB0039
                 };
                 clientOptions.RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true;
                 clientOptions.LocalCertificateSelectionCallback = (sender, targetHost, localCertificates, remoteCertificate, acceptableIssuers) =>
@@ -404,7 +417,7 @@ namespace System.Net.Security.Tests
                 int read = await server.ReadAsync(buffer, cts.Token);
 
                 // Fail as there are still some undrained data (incomplete incoming TLS frame)
-                await Assert.ThrowsAsync<InvalidOperationException>(()=>
+                await Assert.ThrowsAsync<InvalidOperationException>(() =>
                     server.NegotiateClientCertificateAsync(cts.Token)
                 );
 
@@ -567,7 +580,9 @@ namespace System.Net.Security.Tests
                 SslClientAuthenticationOptions clientOptions = new SslClientAuthenticationOptions()
                 {
                     TargetHost = Guid.NewGuid().ToString("N"),
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                     EnabledSslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12,
+#pragma warning restore SYSLIB0039
                 };
                 clientOptions.RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true;
                 clientOptions.LocalCertificateSelectionCallback = (sender, targetHost, localCertificates, remoteCertificate, acceptableIssuers) =>
@@ -732,7 +747,7 @@ namespace System.Net.Security.Tests
         {
             int split = Random.Shared.Next(0, certificates.serverChain.Count - 1);
 
-            var clientOptions = new  SslClientAuthenticationOptions() { TargetHost = "localhost" };
+            var clientOptions = new SslClientAuthenticationOptions() { TargetHost = "localhost" };
             clientOptions.RemoteCertificateValidationCallback =
                 (sender, certificate, chain, sslPolicyErrors) =>
                 {
@@ -794,7 +809,7 @@ namespace System.Net.Security.Tests
         public async Task SslStream_UntrustedCaWithCustomCallback_Throws(bool customCallback)
         {
             string errorMessage;
-            var clientOptions = new  SslClientAuthenticationOptions() { TargetHost = "localhost" };
+            var clientOptions = new SslClientAuthenticationOptions() { TargetHost = "localhost" };
             if (customCallback)
             {
                 clientOptions.RemoteCertificateValidationCallback =
@@ -864,7 +879,7 @@ namespace System.Net.Security.Tests
                 }
             }
 
-            var clientOptions = new  SslClientAuthenticationOptions() { TargetHost = "localhost",  };
+            var clientOptions = new SslClientAuthenticationOptions() { TargetHost = "localhost", };
             clientOptions.RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true;
             clientOptions.LocalCertificateSelectionCallback = (sender, target, certificates, remoteCertificate, issuers) => clientCertificate;
 
@@ -908,7 +923,7 @@ namespace System.Net.Security.Tests
                 c.Dispose();
             }
 
-            foreach (SslStream s in  streams)
+            foreach (SslStream s in streams)
             {
                 s.Dispose();
             }

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs
index 9175833..d40bcf9 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSystemDefaultsTest.cs
@@ -47,11 +47,13 @@ namespace System.Net.Security.Tests
             }
 
 #pragma warning restore 0618
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
             if (PlatformDetection.SupportsTls11)
             {
                 yield return new object[] { SslProtocolSupport.NonTls13Protocols, SslProtocols.Tls11 };
                 yield return new object[] { SslProtocols.Tls11, SslProtocolSupport.NonTls13Protocols };
             }
+#pragma warning restore SYSLIB0039
 
             if (PlatformDetection.SupportsTls12)
             {
@@ -99,7 +101,9 @@ namespace System.Net.Security.Tests
 #pragma warning restore 0618
                 {
                     Assert.True(
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
                         (_clientStream.SslProtocol == SslProtocols.Tls11 && _clientStream.HashAlgorithm == HashAlgorithmType.Sha1) ||
+#pragma warning restore SYSLIB0039
                         _clientStream.HashAlgorithm == HashAlgorithmType.Sha256 ||
                         _clientStream.HashAlgorithm == HashAlgorithmType.Sha384 ||
                         _clientStream.HashAlgorithm == HashAlgorithmType.Sha512,

diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/TlsFrameHelperTests.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/TlsFrameHelperTests.cs
index 02c0eda..83b2877 100644 (file)
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/TlsFrameHelperTests.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/TlsFrameHelperTests.cs
@@ -57,8 +57,10 @@ namespace System.Net.Security.Tests
             TlsFrameHelper.TlsFrameInfo info = default;
             Assert.True(TlsFrameHelper.TryGetFrameInfo(s_Tls12ClientHello, ref info));
 
+#pragma warning disable SYSLIB0039
             Assert.Equal(SslProtocols.Tls, info.Header.Version);
-            Assert.Equal(SslProtocols.Tls|SslProtocols.Tls12, info.SupportedVersions);
+            Assert.Equal(SslProtocols.Tls | SslProtocols.Tls12, info.SupportedVersions);
+#pragma warning restore SYSLIB0039
             Assert.Equal(TlsFrameHelper.ApplicationProtocolInfo.Http11 | TlsFrameHelper.ApplicationProtocolInfo.Http2, info.ApplicationProtocols);
         }
 
@@ -68,8 +70,10 @@ namespace System.Net.Security.Tests
             TlsFrameHelper.TlsFrameInfo info = default;
             Assert.True(TlsFrameHelper.TryGetFrameInfo(s_Tls13ClientHello, ref info));
 
+#pragma warning disable SYSLIB0039
             Assert.Equal(SslProtocols.Tls, info.Header.Version);
             Assert.Equal(SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12 | SslProtocols.Tls13, info.SupportedVersions);
+#pragma warning restore SYSLIB0039
             Assert.Equal(TlsFrameHelper.ApplicationProtocolInfo.Other, info.ApplicationProtocols);
         }
 

diff --git a/src/libraries/System.Net.ServicePoint/src/System/Net/SecurityProtocolType.cs b/src/libraries/System.Net.ServicePoint/src/System/Net/SecurityProtocolType.cs
index 2229363..13c9914 100644 (file)
--- a/src/libraries/System.Net.ServicePoint/src/System/Net/SecurityProtocolType.cs
+++ b/src/libraries/System.Net.ServicePoint/src/System/Net/SecurityProtocolType.cs
@@ -12,8 +12,10 @@ namespace System.Net
 #pragma warning disable CS0618
         Ssl3 = SslProtocols.Ssl3,
 #pragma warning restore CS0618
+#pragma warning disable SYSLIB0039 // TLS 1.0 and 1.1 are obsolete
         Tls = SslProtocols.Tls,
         Tls11 = SslProtocols.Tls11,
+#pragma warning restore SYSLIB0039
         Tls12 = SslProtocols.Tls12,
         Tls13 = SslProtocols.Tls13,
     }