[OSX][TLS 1.3] Network Framework Native Layer + Interop Classes Implementations by liveans · Pull Request #117016 · dotnet/runtime

liveans · 2025-06-25T11:45:39Z

This is the initial part of #1979. Follow-up PRs will handle integration with the PAL layer and the SslStream layer.
I'm splitting the changes into multiple PRs to simplify the review process.

And this PR starting to replace #104835 PoC PR, most of the parts are untouched and directly copy from that PR. Mostly restructured stuff into different library + different interop file.

I'm going to iterate feature progressively, once we merge this, I'm going to create the next PR for PAL + SslStream integration layer.

Copilot

Pull Request Overview

Initial implementation of a native Network Framework layer and corresponding managed interop code to support TLS 1.3 on macOS.

Updated build scripts to link against Apple’s Network framework
Added pal_networkframework C API and entrypoints for TLS operations via Network Framework
Introduced Interop.Network and Interop.NetworkTls for managed interop and updated project files

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link CLI library builder against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Apple app builder target against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Apple library‐mode builder against Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m	Implement TLS handshake and I/O callbacks using Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h	Declare C API for Network Framework TLS functions
src/native/libs/System.Net.Security.Native.Apple/extra_libs.cmake	Find and append Network framework to native link list
src/native/libs/System.Net.Security.Native.Apple/entrypoints.c	Register native TLS entrypoints for DllImport
src/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt	Add and configure System.Net.Security.Native.Apple targets
src/native/libs/CMakeLists.txt	Include System.Net.Security.Native.Apple in native build when targeting Apple
src/mono/msbuild/apple/build/AppleBuild.targets	Add Network framework to Mono Apple app linker args
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Include new Interop.OSX files in library project
src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs	Managed interop for Network Framework TLS operations
src/libraries/Common/src/Interop/OSX/Interop.Network.cs	Managed retain/release wrappers for Network Framework objects
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Define library constants for AppleNetworkNative and NetworkFramework
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Add Network framework to NativeAOT Unix build targets

Comments suppressed due to low confidence (4)

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m:18

AppleNetNative_NwCreateContext currently hardcodes the endpoint to "127.0.0.1:42". Consider accepting host and port parameters or providing a separate function to configure the endpoint rather than using placeholder values.

PALEXPORT nw_connection_t AppleNetNative_NwCreateContext(int32_t isServer)

src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs:1

The new NetworkFramework TLS interop code is not accompanied by any unit tests. Consider adding tests for ALPN serialization, native call success paths, and error handling.

// Licensed to the .NET Foundation under one or more agreements.

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:57

Public functions in this header lack parameter and return-value documentation. Consider adding doc comments to clarify expected behavior, ownership, and possible error codes.

PALEXPORT int32_t AppleNetNative_NwInit(StatusUpdateCallback statusFunc, ReadCallback readFunc, WriteCallback writeFunc);

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:60

The declaration of AppleNetNative_NwProcessInputData includes the nw_framer_t framer parameter, but the header signature in this diff does not match the implementation. Ensure the header and implementation signatures align to avoid compilation errors.

PALEXPORT int32_t AppleNetNative_NwProcessInputData(nw_connection_t connection, nw_framer_t framer, const uint8_t * data, int dataLength);

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

liveans · 2025-06-28T13:33:48Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2025-06-28T13:33:57Z

Azure Pipelines successfully started running 1 pipeline(s).

dotnet-policy-service · 2025-06-28T14:20:30Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

wfurt · 2025-07-01T00:25:25Z

+ throw new ArgumentException(SR.net_ssl_app_protocols_invalid, nameof(applicationProtocols));
+ }
+
+ protocolSize += protocol.Protocol.Length + 2;


I'm wondering if we should put cap somewhere and throw some meaningful exception. I'm wondering if schannel or openssl also have some limits. (could be done as follow-up IMHO)

wfurt · 2025-07-01T00:26:27Z

+ ConnectionCancelled = 103,
+ }
+
+ internal enum OSStatus


don't we already have the OSStatus somewhere...? I would thins most of them are pretty general.

We have only
runtime/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
Lines 17 to 21 in 8104cb1
privateconstintOSStatus_writErr=-20;
privateconstintOSStatus_readErr=-19;
privateconstintOSStatus_noErr=0;
privateconstintOSStatus_errSSLWouldBlock=-9803;
privateconstintInitialBufferSize=2048;
Not sure what the best place for the shared definition would be, maybe Interop.AppleCrypto.OSStatus.

wfurt · 2025-07-01T00:35:38Z

+ framer_options = nw_framer_copy_options(framer);
+
+ NSNumber* num = nw_framer_options_copy_object_value(framer_options, "GCHANDLE");
+ assert(num != NULL);


yes, I think it its up to use to manage it. I think the assert is ok to let us know if our assumptions are wrong. at least in the early stages.

wfurt · 2025-07-01T00:37:22Z

+ [num getValue:&ptr];
+ size_t size = message_length;
+
+ nw_framer_parse_output(framer, 1, message_length, NULL, ^size_t(uint8_t *buffer, size_t buffer_length, bool is_complete2) {


nitL I would rename is_complete2 to is_complete

wfurt · 2025-07-01T00:39:07Z

+};
+
+static nw_framer_cleanup_handler_t framer_cleanup_handler = ^(nw_framer_t framer) {
+ (void)framer;


makes me wonder if we missed something. But if we did not, maybe we don't even need the empty handler. Any thoughts on this @filipnavara ?

vcsjones · 2025-07-01T00:54:38Z

+ // The endpoint values (127.0.0.1:42) are arbitrary - they just need to be
+ // syntactically and semantically valid since the connection is never established.
+ nw_parameters_t nw_parameters = nw_parameters_create_secure_udp(NW_PARAMETERS_DISABLE_PROTOCOL, NW_PARAMETERS_DEFAULT_CONFIGURATION);
+ nw_endpoint_t nw_endpoint = nw_endpoint_create_host("127.0.0.1", "42");


What happens if something is already bound on port 42? Like another .NET process?

nothing. There is no real socket. we just need to create some nw_endpoint.

actually, since this is create_host, maybe we can simply put in some text @liveans instead of using something that looks valid.

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-01T13:48:13Z

I am taking this over to land it in main ASAP while liveans is on vacation. I addressed most of the comments, I also have some Ideas how to move this forward, but will keep them for the followup PRs, PTAL

liveans · 2025-06-25T11:45:39Z

This is the initial part of #1979. Follow-up PRs will handle integration with the PAL layer and the SslStream layer.
I'm splitting the changes into multiple PRs to simplify the review process.

And this PR starting to replace #104835 PoC PR, most of the parts are untouched and directly copy from that PR. Mostly restructured stuff into different library + different interop file.

I'm going to iterate feature progressively, once we merge this, I'm going to create the next PR for PAL + SslStream integration layer.

Copilot

Pull Request Overview

Initial implementation of a native Network Framework layer and corresponding managed interop code to support TLS 1.3 on macOS.

Updated build scripts to link against Apple’s Network framework
Added pal_networkframework C API and entrypoints for TLS operations via Network Framework
Introduced Interop.Network and Interop.NetworkTls for managed interop and updated project files

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link CLI library builder against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Apple app builder target against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Apple library‐mode builder against Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m	Implement TLS handshake and I/O callbacks using Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h	Declare C API for Network Framework TLS functions
src/native/libs/System.Net.Security.Native.Apple/extra_libs.cmake	Find and append Network framework to native link list
src/native/libs/System.Net.Security.Native.Apple/entrypoints.c	Register native TLS entrypoints for DllImport
src/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt	Add and configure System.Net.Security.Native.Apple targets
src/native/libs/CMakeLists.txt	Include System.Net.Security.Native.Apple in native build when targeting Apple
src/mono/msbuild/apple/build/AppleBuild.targets	Add Network framework to Mono Apple app linker args
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Include new Interop.OSX files in library project
src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs	Managed interop for Network Framework TLS operations
src/libraries/Common/src/Interop/OSX/Interop.Network.cs	Managed retain/release wrappers for Network Framework objects
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Define library constants for AppleNetworkNative and NetworkFramework
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Add Network framework to NativeAOT Unix build targets

Comments suppressed due to low confidence (4)

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m:18

AppleNetNative_NwCreateContext currently hardcodes the endpoint to "127.0.0.1:42". Consider accepting host and port parameters or providing a separate function to configure the endpoint rather than using placeholder values.

PALEXPORT nw_connection_t AppleNetNative_NwCreateContext(int32_t isServer)

src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs:1

The new NetworkFramework TLS interop code is not accompanied by any unit tests. Consider adding tests for ALPN serialization, native call success paths, and error handling.

// Licensed to the .NET Foundation under one or more agreements.

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:57

Public functions in this header lack parameter and return-value documentation. Consider adding doc comments to clarify expected behavior, ownership, and possible error codes.

PALEXPORT int32_t AppleNetNative_NwInit(StatusUpdateCallback statusFunc, ReadCallback readFunc, WriteCallback writeFunc);

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:60

The declaration of AppleNetNative_NwProcessInputData includes the nw_framer_t framer parameter, but the header signature in this diff does not match the implementation. Ensure the header and implementation signatures align to avoid compilation errors.

PALEXPORT int32_t AppleNetNative_NwProcessInputData(nw_connection_t connection, nw_framer_t framer, const uint8_t * data, int dataLength);

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

liveans · 2025-06-28T13:33:48Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2025-06-28T13:33:57Z

Azure Pipelines successfully started running 1 pipeline(s).

dotnet-policy-service · 2025-06-28T14:20:30Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

wfurt · 2025-07-01T00:25:25Z

+ throw new ArgumentException(SR.net_ssl_app_protocols_invalid, nameof(applicationProtocols));
+ }
+
+ protocolSize += protocol.Protocol.Length + 2;


I'm wondering if we should put cap somewhere and throw some meaningful exception. I'm wondering if schannel or openssl also have some limits. (could be done as follow-up IMHO)

wfurt · 2025-07-01T00:26:27Z

+ ConnectionCancelled = 103,
+ }
+
+ internal enum OSStatus


don't we already have the OSStatus somewhere...? I would thins most of them are pretty general.

We have only
runtime/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
Lines 17 to 21 in 8104cb1
privateconstintOSStatus_writErr=-20;
privateconstintOSStatus_readErr=-19;
privateconstintOSStatus_noErr=0;
privateconstintOSStatus_errSSLWouldBlock=-9803;
privateconstintInitialBufferSize=2048;
Not sure what the best place for the shared definition would be, maybe Interop.AppleCrypto.OSStatus.

wfurt · 2025-07-01T00:35:38Z

+ framer_options = nw_framer_copy_options(framer);
+
+ NSNumber* num = nw_framer_options_copy_object_value(framer_options, "GCHANDLE");
+ assert(num != NULL);


yes, I think it its up to use to manage it. I think the assert is ok to let us know if our assumptions are wrong. at least in the early stages.

wfurt · 2025-07-01T00:37:22Z

+ [num getValue:&ptr];
+ size_t size = message_length;
+
+ nw_framer_parse_output(framer, 1, message_length, NULL, ^size_t(uint8_t *buffer, size_t buffer_length, bool is_complete2) {


nitL I would rename is_complete2 to is_complete

wfurt · 2025-07-01T00:39:07Z

+};
+
+static nw_framer_cleanup_handler_t framer_cleanup_handler = ^(nw_framer_t framer) {
+ (void)framer;


makes me wonder if we missed something. But if we did not, maybe we don't even need the empty handler. Any thoughts on this @filipnavara ?

vcsjones · 2025-07-01T00:54:38Z

+ // The endpoint values (127.0.0.1:42) are arbitrary - they just need to be
+ // syntactically and semantically valid since the connection is never established.
+ nw_parameters_t nw_parameters = nw_parameters_create_secure_udp(NW_PARAMETERS_DISABLE_PROTOCOL, NW_PARAMETERS_DEFAULT_CONFIGURATION);
+ nw_endpoint_t nw_endpoint = nw_endpoint_create_host("127.0.0.1", "42");


What happens if something is already bound on port 42? Like another .NET process?

nothing. There is no real socket. we just need to create some nw_endpoint.

actually, since this is create_host, maybe we can simply put in some text @liveans instead of using something that looks valid.

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-01T13:48:13Z

I am taking this over to land it in main ASAP while liveans is on vacation. I addressed most of the comments, I also have some Ideas how to move this forward, but will keep them for the followup PRs, PTAL

liveans · 2025-06-25T11:45:39Z

This is the initial part of #1979. Follow-up PRs will handle integration with the PAL layer and the SslStream layer.
I'm splitting the changes into multiple PRs to simplify the review process.

And this PR starting to replace #104835 PoC PR, most of the parts are untouched and directly copy from that PR. Mostly restructured stuff into different library + different interop file.

I'm going to iterate feature progressively, once we merge this, I'm going to create the next PR for PAL + SslStream integration layer.

Copilot

Pull Request Overview

Initial implementation of a native Network Framework layer and corresponding managed interop code to support TLS 1.3 on macOS.

Updated build scripts to link against Apple’s Network framework
Added pal_networkframework C API and entrypoints for TLS operations via Network Framework
Introduced Interop.Network and Interop.NetworkTls for managed interop and updated project files

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link CLI library builder against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Apple app builder target against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Apple library‐mode builder against Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m	Implement TLS handshake and I/O callbacks using Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h	Declare C API for Network Framework TLS functions
src/native/libs/System.Net.Security.Native.Apple/extra_libs.cmake	Find and append Network framework to native link list
src/native/libs/System.Net.Security.Native.Apple/entrypoints.c	Register native TLS entrypoints for DllImport
src/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt	Add and configure System.Net.Security.Native.Apple targets
src/native/libs/CMakeLists.txt	Include System.Net.Security.Native.Apple in native build when targeting Apple
src/mono/msbuild/apple/build/AppleBuild.targets	Add Network framework to Mono Apple app linker args
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Include new Interop.OSX files in library project
src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs	Managed interop for Network Framework TLS operations
src/libraries/Common/src/Interop/OSX/Interop.Network.cs	Managed retain/release wrappers for Network Framework objects
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Define library constants for AppleNetworkNative and NetworkFramework
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Add Network framework to NativeAOT Unix build targets

Comments suppressed due to low confidence (4)

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m:18

AppleNetNative_NwCreateContext currently hardcodes the endpoint to "127.0.0.1:42". Consider accepting host and port parameters or providing a separate function to configure the endpoint rather than using placeholder values.

PALEXPORT nw_connection_t AppleNetNative_NwCreateContext(int32_t isServer)

src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs:1

The new NetworkFramework TLS interop code is not accompanied by any unit tests. Consider adding tests for ALPN serialization, native call success paths, and error handling.

// Licensed to the .NET Foundation under one or more agreements.

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:57

Public functions in this header lack parameter and return-value documentation. Consider adding doc comments to clarify expected behavior, ownership, and possible error codes.

PALEXPORT int32_t AppleNetNative_NwInit(StatusUpdateCallback statusFunc, ReadCallback readFunc, WriteCallback writeFunc);

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:60

The declaration of AppleNetNative_NwProcessInputData includes the nw_framer_t framer parameter, but the header signature in this diff does not match the implementation. Ensure the header and implementation signatures align to avoid compilation errors.

PALEXPORT int32_t AppleNetNative_NwProcessInputData(nw_connection_t connection, nw_framer_t framer, const uint8_t * data, int dataLength);

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

liveans · 2025-06-28T13:33:48Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2025-06-28T13:33:57Z

Azure Pipelines successfully started running 1 pipeline(s).

dotnet-policy-service · 2025-06-28T14:20:30Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

wfurt · 2025-07-01T00:25:25Z

+ throw new ArgumentException(SR.net_ssl_app_protocols_invalid, nameof(applicationProtocols));
+ }
+
+ protocolSize += protocol.Protocol.Length + 2;


I'm wondering if we should put cap somewhere and throw some meaningful exception. I'm wondering if schannel or openssl also have some limits. (could be done as follow-up IMHO)

wfurt · 2025-07-01T00:26:27Z

+ ConnectionCancelled = 103,
+ }
+
+ internal enum OSStatus


don't we already have the OSStatus somewhere...? I would thins most of them are pretty general.

We have only
runtime/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
Lines 17 to 21 in 8104cb1
privateconstintOSStatus_writErr=-20;
privateconstintOSStatus_readErr=-19;
privateconstintOSStatus_noErr=0;
privateconstintOSStatus_errSSLWouldBlock=-9803;
privateconstintInitialBufferSize=2048;
Not sure what the best place for the shared definition would be, maybe Interop.AppleCrypto.OSStatus.

wfurt · 2025-07-01T00:35:38Z

+ framer_options = nw_framer_copy_options(framer);
+
+ NSNumber* num = nw_framer_options_copy_object_value(framer_options, "GCHANDLE");
+ assert(num != NULL);


yes, I think it its up to use to manage it. I think the assert is ok to let us know if our assumptions are wrong. at least in the early stages.

wfurt · 2025-07-01T00:37:22Z

+ [num getValue:&ptr];
+ size_t size = message_length;
+
+ nw_framer_parse_output(framer, 1, message_length, NULL, ^size_t(uint8_t *buffer, size_t buffer_length, bool is_complete2) {


nitL I would rename is_complete2 to is_complete

wfurt · 2025-07-01T00:39:07Z

+};
+
+static nw_framer_cleanup_handler_t framer_cleanup_handler = ^(nw_framer_t framer) {
+ (void)framer;


makes me wonder if we missed something. But if we did not, maybe we don't even need the empty handler. Any thoughts on this @filipnavara ?

vcsjones · 2025-07-01T00:54:38Z

+ // The endpoint values (127.0.0.1:42) are arbitrary - they just need to be
+ // syntactically and semantically valid since the connection is never established.
+ nw_parameters_t nw_parameters = nw_parameters_create_secure_udp(NW_PARAMETERS_DISABLE_PROTOCOL, NW_PARAMETERS_DEFAULT_CONFIGURATION);
+ nw_endpoint_t nw_endpoint = nw_endpoint_create_host("127.0.0.1", "42");


What happens if something is already bound on port 42? Like another .NET process?

nothing. There is no real socket. we just need to create some nw_endpoint.

actually, since this is create_host, maybe we can simply put in some text @liveans instead of using something that looks valid.

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-01T13:48:13Z

I am taking this over to land it in main ASAP while liveans is on vacation. I addressed most of the comments, I also have some Ideas how to move this forward, but will keep them for the followup PRs, PTAL

liveans · 2025-06-25T11:45:39Z

This is the initial part of #1979. Follow-up PRs will handle integration with the PAL layer and the SslStream layer.
I'm splitting the changes into multiple PRs to simplify the review process.

And this PR starting to replace #104835 PoC PR, most of the parts are untouched and directly copy from that PR. Mostly restructured stuff into different library + different interop file.

I'm going to iterate feature progressively, once we merge this, I'm going to create the next PR for PAL + SslStream integration layer.

Copilot

Pull Request Overview

Initial implementation of a native Network Framework layer and corresponding managed interop code to support TLS 1.3 on macOS.

Updated build scripts to link against Apple’s Network framework
Added pal_networkframework C API and entrypoints for TLS operations via Network Framework
Introduced Interop.Network and Interop.NetworkTls for managed interop and updated project files

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link CLI library builder against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Apple app builder target against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Apple library‐mode builder against Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m	Implement TLS handshake and I/O callbacks using Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h	Declare C API for Network Framework TLS functions
src/native/libs/System.Net.Security.Native.Apple/extra_libs.cmake	Find and append Network framework to native link list
src/native/libs/System.Net.Security.Native.Apple/entrypoints.c	Register native TLS entrypoints for DllImport
src/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt	Add and configure System.Net.Security.Native.Apple targets
src/native/libs/CMakeLists.txt	Include System.Net.Security.Native.Apple in native build when targeting Apple
src/mono/msbuild/apple/build/AppleBuild.targets	Add Network framework to Mono Apple app linker args
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Include new Interop.OSX files in library project
src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs	Managed interop for Network Framework TLS operations
src/libraries/Common/src/Interop/OSX/Interop.Network.cs	Managed retain/release wrappers for Network Framework objects
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Define library constants for AppleNetworkNative and NetworkFramework
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Add Network framework to NativeAOT Unix build targets

Comments suppressed due to low confidence (4)

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m:18

AppleNetNative_NwCreateContext currently hardcodes the endpoint to "127.0.0.1:42". Consider accepting host and port parameters or providing a separate function to configure the endpoint rather than using placeholder values.

PALEXPORT nw_connection_t AppleNetNative_NwCreateContext(int32_t isServer)

src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs:1

The new NetworkFramework TLS interop code is not accompanied by any unit tests. Consider adding tests for ALPN serialization, native call success paths, and error handling.

// Licensed to the .NET Foundation under one or more agreements.

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:57

Public functions in this header lack parameter and return-value documentation. Consider adding doc comments to clarify expected behavior, ownership, and possible error codes.

PALEXPORT int32_t AppleNetNative_NwInit(StatusUpdateCallback statusFunc, ReadCallback readFunc, WriteCallback writeFunc);

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:60

The declaration of AppleNetNative_NwProcessInputData includes the nw_framer_t framer parameter, but the header signature in this diff does not match the implementation. Ensure the header and implementation signatures align to avoid compilation errors.

PALEXPORT int32_t AppleNetNative_NwProcessInputData(nw_connection_t connection, nw_framer_t framer, const uint8_t * data, int dataLength);

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

liveans · 2025-06-28T13:33:48Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2025-06-28T13:33:57Z

Azure Pipelines successfully started running 1 pipeline(s).

dotnet-policy-service · 2025-06-28T14:20:30Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

wfurt · 2025-07-01T00:25:25Z

+ throw new ArgumentException(SR.net_ssl_app_protocols_invalid, nameof(applicationProtocols));
+ }
+
+ protocolSize += protocol.Protocol.Length + 2;


I'm wondering if we should put cap somewhere and throw some meaningful exception. I'm wondering if schannel or openssl also have some limits. (could be done as follow-up IMHO)

wfurt · 2025-07-01T00:26:27Z

+ ConnectionCancelled = 103,
+ }
+
+ internal enum OSStatus


don't we already have the OSStatus somewhere...? I would thins most of them are pretty general.

We have only
runtime/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
Lines 17 to 21 in 8104cb1
privateconstintOSStatus_writErr=-20;
privateconstintOSStatus_readErr=-19;
privateconstintOSStatus_noErr=0;
privateconstintOSStatus_errSSLWouldBlock=-9803;
privateconstintInitialBufferSize=2048;
Not sure what the best place for the shared definition would be, maybe Interop.AppleCrypto.OSStatus.

wfurt · 2025-07-01T00:35:38Z

+ framer_options = nw_framer_copy_options(framer);
+
+ NSNumber* num = nw_framer_options_copy_object_value(framer_options, "GCHANDLE");
+ assert(num != NULL);


yes, I think it its up to use to manage it. I think the assert is ok to let us know if our assumptions are wrong. at least in the early stages.

wfurt · 2025-07-01T00:37:22Z

+ [num getValue:&ptr];
+ size_t size = message_length;
+
+ nw_framer_parse_output(framer, 1, message_length, NULL, ^size_t(uint8_t *buffer, size_t buffer_length, bool is_complete2) {


nitL I would rename is_complete2 to is_complete

wfurt · 2025-07-01T00:39:07Z

+};
+
+static nw_framer_cleanup_handler_t framer_cleanup_handler = ^(nw_framer_t framer) {
+ (void)framer;


makes me wonder if we missed something. But if we did not, maybe we don't even need the empty handler. Any thoughts on this @filipnavara ?

vcsjones · 2025-07-01T00:54:38Z

+ // The endpoint values (127.0.0.1:42) are arbitrary - they just need to be
+ // syntactically and semantically valid since the connection is never established.
+ nw_parameters_t nw_parameters = nw_parameters_create_secure_udp(NW_PARAMETERS_DISABLE_PROTOCOL, NW_PARAMETERS_DEFAULT_CONFIGURATION);
+ nw_endpoint_t nw_endpoint = nw_endpoint_create_host("127.0.0.1", "42");


What happens if something is already bound on port 42? Like another .NET process?

nothing. There is no real socket. we just need to create some nw_endpoint.

actually, since this is create_host, maybe we can simply put in some text @liveans instead of using something that looks valid.

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-01T13:48:13Z

I am taking this over to land it in main ASAP while liveans is on vacation. I addressed most of the comments, I also have some Ideas how to move this forward, but will keep them for the followup PRs, PTAL

liveans · 2025-06-25T11:45:39Z

This is the initial part of #1979. Follow-up PRs will handle integration with the PAL layer and the SslStream layer.
I'm splitting the changes into multiple PRs to simplify the review process.

And this PR starting to replace #104835 PoC PR, most of the parts are untouched and directly copy from that PR. Mostly restructured stuff into different library + different interop file.

I'm going to iterate feature progressively, once we merge this, I'm going to create the next PR for PAL + SslStream integration layer.

Copilot

Pull Request Overview

Initial implementation of a native Network Framework layer and corresponding managed interop code to support TLS 1.3 on macOS.

Updated build scripts to link against Apple’s Network framework
Added pal_networkframework C API and entrypoints for TLS operations via Network Framework
Introduced Interop.Network and Interop.NetworkTls for managed interop and updated project files

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link CLI library builder against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Apple app builder target against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Apple library‐mode builder against Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m	Implement TLS handshake and I/O callbacks using Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h	Declare C API for Network Framework TLS functions
src/native/libs/System.Net.Security.Native.Apple/extra_libs.cmake	Find and append Network framework to native link list
src/native/libs/System.Net.Security.Native.Apple/entrypoints.c	Register native TLS entrypoints for DllImport
src/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt	Add and configure System.Net.Security.Native.Apple targets
src/native/libs/CMakeLists.txt	Include System.Net.Security.Native.Apple in native build when targeting Apple
src/mono/msbuild/apple/build/AppleBuild.targets	Add Network framework to Mono Apple app linker args
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Include new Interop.OSX files in library project
src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs	Managed interop for Network Framework TLS operations
src/libraries/Common/src/Interop/OSX/Interop.Network.cs	Managed retain/release wrappers for Network Framework objects
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Define library constants for AppleNetworkNative and NetworkFramework
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Add Network framework to NativeAOT Unix build targets

Comments suppressed due to low confidence (4)

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m:18

AppleNetNative_NwCreateContext currently hardcodes the endpoint to "127.0.0.1:42". Consider accepting host and port parameters or providing a separate function to configure the endpoint rather than using placeholder values.

PALEXPORT nw_connection_t AppleNetNative_NwCreateContext(int32_t isServer)

src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs:1

The new NetworkFramework TLS interop code is not accompanied by any unit tests. Consider adding tests for ALPN serialization, native call success paths, and error handling.

// Licensed to the .NET Foundation under one or more agreements.

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:57

Public functions in this header lack parameter and return-value documentation. Consider adding doc comments to clarify expected behavior, ownership, and possible error codes.

PALEXPORT int32_t AppleNetNative_NwInit(StatusUpdateCallback statusFunc, ReadCallback readFunc, WriteCallback writeFunc);

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:60

The declaration of AppleNetNative_NwProcessInputData includes the nw_framer_t framer parameter, but the header signature in this diff does not match the implementation. Ensure the header and implementation signatures align to avoid compilation errors.

PALEXPORT int32_t AppleNetNative_NwProcessInputData(nw_connection_t connection, nw_framer_t framer, const uint8_t * data, int dataLength);

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

liveans · 2025-06-28T13:33:48Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2025-06-28T13:33:57Z

Azure Pipelines successfully started running 1 pipeline(s).

dotnet-policy-service · 2025-06-28T14:20:30Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

wfurt · 2025-07-01T00:25:25Z

+ throw new ArgumentException(SR.net_ssl_app_protocols_invalid, nameof(applicationProtocols));
+ }
+
+ protocolSize += protocol.Protocol.Length + 2;


I'm wondering if we should put cap somewhere and throw some meaningful exception. I'm wondering if schannel or openssl also have some limits. (could be done as follow-up IMHO)

wfurt · 2025-07-01T00:26:27Z

+ ConnectionCancelled = 103,
+ }
+
+ internal enum OSStatus


don't we already have the OSStatus somewhere...? I would thins most of them are pretty general.

We have only
runtime/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
Lines 17 to 21 in 8104cb1
privateconstintOSStatus_writErr=-20;
privateconstintOSStatus_readErr=-19;
privateconstintOSStatus_noErr=0;
privateconstintOSStatus_errSSLWouldBlock=-9803;
privateconstintInitialBufferSize=2048;
Not sure what the best place for the shared definition would be, maybe Interop.AppleCrypto.OSStatus.

wfurt · 2025-07-01T00:35:38Z

+ framer_options = nw_framer_copy_options(framer);
+
+ NSNumber* num = nw_framer_options_copy_object_value(framer_options, "GCHANDLE");
+ assert(num != NULL);


yes, I think it its up to use to manage it. I think the assert is ok to let us know if our assumptions are wrong. at least in the early stages.

wfurt · 2025-07-01T00:37:22Z

+ [num getValue:&ptr];
+ size_t size = message_length;
+
+ nw_framer_parse_output(framer, 1, message_length, NULL, ^size_t(uint8_t *buffer, size_t buffer_length, bool is_complete2) {


nitL I would rename is_complete2 to is_complete

wfurt · 2025-07-01T00:39:07Z

+};
+
+static nw_framer_cleanup_handler_t framer_cleanup_handler = ^(nw_framer_t framer) {
+ (void)framer;


makes me wonder if we missed something. But if we did not, maybe we don't even need the empty handler. Any thoughts on this @filipnavara ?

vcsjones · 2025-07-01T00:54:38Z

+ // The endpoint values (127.0.0.1:42) are arbitrary - they just need to be
+ // syntactically and semantically valid since the connection is never established.
+ nw_parameters_t nw_parameters = nw_parameters_create_secure_udp(NW_PARAMETERS_DISABLE_PROTOCOL, NW_PARAMETERS_DEFAULT_CONFIGURATION);
+ nw_endpoint_t nw_endpoint = nw_endpoint_create_host("127.0.0.1", "42");


What happens if something is already bound on port 42? Like another .NET process?

nothing. There is no real socket. we just need to create some nw_endpoint.

actually, since this is create_host, maybe we can simply put in some text @liveans instead of using something that looks valid.

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-01T13:48:13Z

I am taking this over to land it in main ASAP while liveans is on vacation. I addressed most of the comments, I also have some Ideas how to move this forward, but will keep them for the followup PRs, PTAL

liveans · 2025-06-25T11:45:39Z

This is the initial part of #1979. Follow-up PRs will handle integration with the PAL layer and the SslStream layer.
I'm splitting the changes into multiple PRs to simplify the review process.

And this PR starting to replace #104835 PoC PR, most of the parts are untouched and directly copy from that PR. Mostly restructured stuff into different library + different interop file.

I'm going to iterate feature progressively, once we merge this, I'm going to create the next PR for PAL + SslStream integration layer.

Copilot

Pull Request Overview

Initial implementation of a native Network Framework layer and corresponding managed interop code to support TLS 1.3 on macOS.

Updated build scripts to link against Apple’s Network framework
Added pal_networkframework C API and entrypoints for TLS operations via Network Framework
Introduced Interop.Network and Interop.NetworkTls for managed interop and updated project files

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link CLI library builder against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Apple app builder target against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Apple library‐mode builder against Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m	Implement TLS handshake and I/O callbacks using Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h	Declare C API for Network Framework TLS functions
src/native/libs/System.Net.Security.Native.Apple/extra_libs.cmake	Find and append Network framework to native link list
src/native/libs/System.Net.Security.Native.Apple/entrypoints.c	Register native TLS entrypoints for DllImport
src/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt	Add and configure System.Net.Security.Native.Apple targets
src/native/libs/CMakeLists.txt	Include System.Net.Security.Native.Apple in native build when targeting Apple
src/mono/msbuild/apple/build/AppleBuild.targets	Add Network framework to Mono Apple app linker args
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Include new Interop.OSX files in library project
src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs	Managed interop for Network Framework TLS operations
src/libraries/Common/src/Interop/OSX/Interop.Network.cs	Managed retain/release wrappers for Network Framework objects
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Define library constants for AppleNetworkNative and NetworkFramework
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Add Network framework to NativeAOT Unix build targets

Comments suppressed due to low confidence (4)

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m:18

AppleNetNative_NwCreateContext currently hardcodes the endpoint to "127.0.0.1:42". Consider accepting host and port parameters or providing a separate function to configure the endpoint rather than using placeholder values.

PALEXPORT nw_connection_t AppleNetNative_NwCreateContext(int32_t isServer)

src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs:1

The new NetworkFramework TLS interop code is not accompanied by any unit tests. Consider adding tests for ALPN serialization, native call success paths, and error handling.

// Licensed to the .NET Foundation under one or more agreements.

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:57

Public functions in this header lack parameter and return-value documentation. Consider adding doc comments to clarify expected behavior, ownership, and possible error codes.

PALEXPORT int32_t AppleNetNative_NwInit(StatusUpdateCallback statusFunc, ReadCallback readFunc, WriteCallback writeFunc);

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:60

The declaration of AppleNetNative_NwProcessInputData includes the nw_framer_t framer parameter, but the header signature in this diff does not match the implementation. Ensure the header and implementation signatures align to avoid compilation errors.

PALEXPORT int32_t AppleNetNative_NwProcessInputData(nw_connection_t connection, nw_framer_t framer, const uint8_t * data, int dataLength);

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

liveans · 2025-06-28T13:33:48Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2025-06-28T13:33:57Z

Azure Pipelines successfully started running 1 pipeline(s).

dotnet-policy-service · 2025-06-28T14:20:30Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

wfurt · 2025-07-01T00:25:25Z

+ throw new ArgumentException(SR.net_ssl_app_protocols_invalid, nameof(applicationProtocols));
+ }
+
+ protocolSize += protocol.Protocol.Length + 2;


I'm wondering if we should put cap somewhere and throw some meaningful exception. I'm wondering if schannel or openssl also have some limits. (could be done as follow-up IMHO)

wfurt · 2025-07-01T00:26:27Z

+ ConnectionCancelled = 103,
+ }
+
+ internal enum OSStatus


don't we already have the OSStatus somewhere...? I would thins most of them are pretty general.

We have only
runtime/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
Lines 17 to 21 in 8104cb1
privateconstintOSStatus_writErr=-20;
privateconstintOSStatus_readErr=-19;
privateconstintOSStatus_noErr=0;
privateconstintOSStatus_errSSLWouldBlock=-9803;
privateconstintInitialBufferSize=2048;
Not sure what the best place for the shared definition would be, maybe Interop.AppleCrypto.OSStatus.

wfurt · 2025-07-01T00:35:38Z

+ framer_options = nw_framer_copy_options(framer);
+
+ NSNumber* num = nw_framer_options_copy_object_value(framer_options, "GCHANDLE");
+ assert(num != NULL);


yes, I think it its up to use to manage it. I think the assert is ok to let us know if our assumptions are wrong. at least in the early stages.

wfurt · 2025-07-01T00:37:22Z

+ [num getValue:&ptr];
+ size_t size = message_length;
+
+ nw_framer_parse_output(framer, 1, message_length, NULL, ^size_t(uint8_t *buffer, size_t buffer_length, bool is_complete2) {


nitL I would rename is_complete2 to is_complete

wfurt · 2025-07-01T00:39:07Z

+};
+
+static nw_framer_cleanup_handler_t framer_cleanup_handler = ^(nw_framer_t framer) {
+ (void)framer;


makes me wonder if we missed something. But if we did not, maybe we don't even need the empty handler. Any thoughts on this @filipnavara ?

vcsjones · 2025-07-01T00:54:38Z

+ // The endpoint values (127.0.0.1:42) are arbitrary - they just need to be
+ // syntactically and semantically valid since the connection is never established.
+ nw_parameters_t nw_parameters = nw_parameters_create_secure_udp(NW_PARAMETERS_DISABLE_PROTOCOL, NW_PARAMETERS_DEFAULT_CONFIGURATION);
+ nw_endpoint_t nw_endpoint = nw_endpoint_create_host("127.0.0.1", "42");


What happens if something is already bound on port 42? Like another .NET process?

nothing. There is no real socket. we just need to create some nw_endpoint.

actually, since this is create_host, maybe we can simply put in some text @liveans instead of using something that looks valid.

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-01T13:48:13Z

I am taking this over to land it in main ASAP while liveans is on vacation. I addressed most of the comments, I also have some Ideas how to move this forward, but will keep them for the followup PRs, PTAL

liveans · 2025-06-25T11:45:39Z

This is the initial part of #1979. Follow-up PRs will handle integration with the PAL layer and the SslStream layer.
I'm splitting the changes into multiple PRs to simplify the review process.

And this PR starting to replace #104835 PoC PR, most of the parts are untouched and directly copy from that PR. Mostly restructured stuff into different library + different interop file.

I'm going to iterate feature progressively, once we merge this, I'm going to create the next PR for PAL + SslStream integration layer.

Copilot

Pull Request Overview

Initial implementation of a native Network Framework layer and corresponding managed interop code to support TLS 1.3 on macOS.

Updated build scripts to link against Apple’s Network framework
Added pal_networkframework C API and entrypoints for TLS operations via Network Framework
Introduced Interop.Network and Interop.NetworkTls for managed interop and updated project files

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link CLI library builder against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Apple app builder target against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Apple library‐mode builder against Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m	Implement TLS handshake and I/O callbacks using Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h	Declare C API for Network Framework TLS functions
src/native/libs/System.Net.Security.Native.Apple/extra_libs.cmake	Find and append Network framework to native link list
src/native/libs/System.Net.Security.Native.Apple/entrypoints.c	Register native TLS entrypoints for DllImport
src/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt	Add and configure System.Net.Security.Native.Apple targets
src/native/libs/CMakeLists.txt	Include System.Net.Security.Native.Apple in native build when targeting Apple
src/mono/msbuild/apple/build/AppleBuild.targets	Add Network framework to Mono Apple app linker args
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Include new Interop.OSX files in library project
src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs	Managed interop for Network Framework TLS operations
src/libraries/Common/src/Interop/OSX/Interop.Network.cs	Managed retain/release wrappers for Network Framework objects
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Define library constants for AppleNetworkNative and NetworkFramework
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Add Network framework to NativeAOT Unix build targets

Comments suppressed due to low confidence (4)

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m:18

AppleNetNative_NwCreateContext currently hardcodes the endpoint to "127.0.0.1:42". Consider accepting host and port parameters or providing a separate function to configure the endpoint rather than using placeholder values.

PALEXPORT nw_connection_t AppleNetNative_NwCreateContext(int32_t isServer)

src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs:1

The new NetworkFramework TLS interop code is not accompanied by any unit tests. Consider adding tests for ALPN serialization, native call success paths, and error handling.

// Licensed to the .NET Foundation under one or more agreements.

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:57

Public functions in this header lack parameter and return-value documentation. Consider adding doc comments to clarify expected behavior, ownership, and possible error codes.

PALEXPORT int32_t AppleNetNative_NwInit(StatusUpdateCallback statusFunc, ReadCallback readFunc, WriteCallback writeFunc);

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:60

The declaration of AppleNetNative_NwProcessInputData includes the nw_framer_t framer parameter, but the header signature in this diff does not match the implementation. Ensure the header and implementation signatures align to avoid compilation errors.

PALEXPORT int32_t AppleNetNative_NwProcessInputData(nw_connection_t connection, nw_framer_t framer, const uint8_t * data, int dataLength);

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

liveans · 2025-06-28T13:33:48Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2025-06-28T13:33:57Z

Azure Pipelines successfully started running 1 pipeline(s).

dotnet-policy-service · 2025-06-28T14:20:30Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

wfurt · 2025-07-01T00:25:25Z

+ throw new ArgumentException(SR.net_ssl_app_protocols_invalid, nameof(applicationProtocols));
+ }
+
+ protocolSize += protocol.Protocol.Length + 2;


I'm wondering if we should put cap somewhere and throw some meaningful exception. I'm wondering if schannel or openssl also have some limits. (could be done as follow-up IMHO)

wfurt · 2025-07-01T00:26:27Z

+ ConnectionCancelled = 103,
+ }
+
+ internal enum OSStatus


don't we already have the OSStatus somewhere...? I would thins most of them are pretty general.

We have only
runtime/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
Lines 17 to 21 in 8104cb1
privateconstintOSStatus_writErr=-20;
privateconstintOSStatus_readErr=-19;
privateconstintOSStatus_noErr=0;
privateconstintOSStatus_errSSLWouldBlock=-9803;
privateconstintInitialBufferSize=2048;
Not sure what the best place for the shared definition would be, maybe Interop.AppleCrypto.OSStatus.

wfurt · 2025-07-01T00:35:38Z

+ framer_options = nw_framer_copy_options(framer);
+
+ NSNumber* num = nw_framer_options_copy_object_value(framer_options, "GCHANDLE");
+ assert(num != NULL);


yes, I think it its up to use to manage it. I think the assert is ok to let us know if our assumptions are wrong. at least in the early stages.

wfurt · 2025-07-01T00:37:22Z

+ [num getValue:&ptr];
+ size_t size = message_length;
+
+ nw_framer_parse_output(framer, 1, message_length, NULL, ^size_t(uint8_t *buffer, size_t buffer_length, bool is_complete2) {


nitL I would rename is_complete2 to is_complete

wfurt · 2025-07-01T00:39:07Z

+};
+
+static nw_framer_cleanup_handler_t framer_cleanup_handler = ^(nw_framer_t framer) {
+ (void)framer;


makes me wonder if we missed something. But if we did not, maybe we don't even need the empty handler. Any thoughts on this @filipnavara ?

vcsjones · 2025-07-01T00:54:38Z

+ // The endpoint values (127.0.0.1:42) are arbitrary - they just need to be
+ // syntactically and semantically valid since the connection is never established.
+ nw_parameters_t nw_parameters = nw_parameters_create_secure_udp(NW_PARAMETERS_DISABLE_PROTOCOL, NW_PARAMETERS_DEFAULT_CONFIGURATION);
+ nw_endpoint_t nw_endpoint = nw_endpoint_create_host("127.0.0.1", "42");


What happens if something is already bound on port 42? Like another .NET process?

nothing. There is no real socket. we just need to create some nw_endpoint.

actually, since this is create_host, maybe we can simply put in some text @liveans instead of using something that looks valid.

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-01T13:48:13Z

I am taking this over to land it in main ASAP while liveans is on vacation. I addressed most of the comments, I also have some Ideas how to move this forward, but will keep them for the followup PRs, PTAL

liveans · 2025-06-25T11:45:39Z

This is the initial part of #1979. Follow-up PRs will handle integration with the PAL layer and the SslStream layer.
I'm splitting the changes into multiple PRs to simplify the review process.

And this PR starting to replace #104835 PoC PR, most of the parts are untouched and directly copy from that PR. Mostly restructured stuff into different library + different interop file.

I'm going to iterate feature progressively, once we merge this, I'm going to create the next PR for PAL + SslStream integration layer.

Copilot

Pull Request Overview

Initial implementation of a native Network Framework layer and corresponding managed interop code to support TLS 1.3 on macOS.

Updated build scripts to link against Apple’s Network framework
Added pal_networkframework C API and entrypoints for TLS operations via Network Framework
Introduced Interop.Network and Interop.NetworkTls for managed interop and updated project files

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link CLI library builder against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Apple app builder target against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Apple library‐mode builder against Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m	Implement TLS handshake and I/O callbacks using Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h	Declare C API for Network Framework TLS functions
src/native/libs/System.Net.Security.Native.Apple/extra_libs.cmake	Find and append Network framework to native link list
src/native/libs/System.Net.Security.Native.Apple/entrypoints.c	Register native TLS entrypoints for DllImport
src/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt	Add and configure System.Net.Security.Native.Apple targets
src/native/libs/CMakeLists.txt	Include System.Net.Security.Native.Apple in native build when targeting Apple
src/mono/msbuild/apple/build/AppleBuild.targets	Add Network framework to Mono Apple app linker args
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Include new Interop.OSX files in library project
src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs	Managed interop for Network Framework TLS operations
src/libraries/Common/src/Interop/OSX/Interop.Network.cs	Managed retain/release wrappers for Network Framework objects
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Define library constants for AppleNetworkNative and NetworkFramework
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Add Network framework to NativeAOT Unix build targets

Comments suppressed due to low confidence (4)

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m:18

AppleNetNative_NwCreateContext currently hardcodes the endpoint to "127.0.0.1:42". Consider accepting host and port parameters or providing a separate function to configure the endpoint rather than using placeholder values.

PALEXPORT nw_connection_t AppleNetNative_NwCreateContext(int32_t isServer)

src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs:1

The new NetworkFramework TLS interop code is not accompanied by any unit tests. Consider adding tests for ALPN serialization, native call success paths, and error handling.

// Licensed to the .NET Foundation under one or more agreements.

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:57

Public functions in this header lack parameter and return-value documentation. Consider adding doc comments to clarify expected behavior, ownership, and possible error codes.

PALEXPORT int32_t AppleNetNative_NwInit(StatusUpdateCallback statusFunc, ReadCallback readFunc, WriteCallback writeFunc);

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:60

The declaration of AppleNetNative_NwProcessInputData includes the nw_framer_t framer parameter, but the header signature in this diff does not match the implementation. Ensure the header and implementation signatures align to avoid compilation errors.

PALEXPORT int32_t AppleNetNative_NwProcessInputData(nw_connection_t connection, nw_framer_t framer, const uint8_t * data, int dataLength);

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

liveans · 2025-06-28T13:33:48Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2025-06-28T13:33:57Z

Azure Pipelines successfully started running 1 pipeline(s).

dotnet-policy-service · 2025-06-28T14:20:30Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

wfurt · 2025-07-01T00:25:25Z

+ throw new ArgumentException(SR.net_ssl_app_protocols_invalid, nameof(applicationProtocols));
+ }
+
+ protocolSize += protocol.Protocol.Length + 2;


I'm wondering if we should put cap somewhere and throw some meaningful exception. I'm wondering if schannel or openssl also have some limits. (could be done as follow-up IMHO)

wfurt · 2025-07-01T00:26:27Z

+ ConnectionCancelled = 103,
+ }
+
+ internal enum OSStatus


don't we already have the OSStatus somewhere...? I would thins most of them are pretty general.

We have only
runtime/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
Lines 17 to 21 in 8104cb1
privateconstintOSStatus_writErr=-20;
privateconstintOSStatus_readErr=-19;
privateconstintOSStatus_noErr=0;
privateconstintOSStatus_errSSLWouldBlock=-9803;
privateconstintInitialBufferSize=2048;
Not sure what the best place for the shared definition would be, maybe Interop.AppleCrypto.OSStatus.

wfurt · 2025-07-01T00:35:38Z

+ framer_options = nw_framer_copy_options(framer);
+
+ NSNumber* num = nw_framer_options_copy_object_value(framer_options, "GCHANDLE");
+ assert(num != NULL);


yes, I think it its up to use to manage it. I think the assert is ok to let us know if our assumptions are wrong. at least in the early stages.

wfurt · 2025-07-01T00:37:22Z

+ [num getValue:&ptr];
+ size_t size = message_length;
+
+ nw_framer_parse_output(framer, 1, message_length, NULL, ^size_t(uint8_t *buffer, size_t buffer_length, bool is_complete2) {


nitL I would rename is_complete2 to is_complete

wfurt · 2025-07-01T00:39:07Z

+};
+
+static nw_framer_cleanup_handler_t framer_cleanup_handler = ^(nw_framer_t framer) {
+ (void)framer;


makes me wonder if we missed something. But if we did not, maybe we don't even need the empty handler. Any thoughts on this @filipnavara ?

vcsjones · 2025-07-01T00:54:38Z

+ // The endpoint values (127.0.0.1:42) are arbitrary - they just need to be
+ // syntactically and semantically valid since the connection is never established.
+ nw_parameters_t nw_parameters = nw_parameters_create_secure_udp(NW_PARAMETERS_DISABLE_PROTOCOL, NW_PARAMETERS_DEFAULT_CONFIGURATION);
+ nw_endpoint_t nw_endpoint = nw_endpoint_create_host("127.0.0.1", "42");


What happens if something is already bound on port 42? Like another .NET process?

nothing. There is no real socket. we just need to create some nw_endpoint.

actually, since this is create_host, maybe we can simply put in some text @liveans instead of using something that looks valid.

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-01T13:48:13Z

I am taking this over to land it in main ASAP while liveans is on vacation. I addressed most of the comments, I also have some Ideas how to move this forward, but will keep them for the followup PRs, PTAL

Ahmet İbrahim Aksoy added 6 commits June 16, 2025 19:54

Native Interop Layer
c062e18

Native Layer Compilation fix for Mono + NativeAOT + templates
ecba3f7

First shape of new native + interop
bf130f3

Newlines at the end of files
0dcc599

Default constructor ownsHandle to true
44b3597

Delete couple of unsafe keyword in Interop
3cbcea7

liveans requested review from a team, Copilot, rzikm, stephentoub and wfurt June 25, 2025 11:45

liveans requested review from MichalStrehovsky, steveisok and vitek-karas as code owners June 25, 2025 11:45

github-actionsBot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Jun 25, 2025

dotnet-policy-serviceBot assigned liveans Jun 25, 2025

CopilotAI reviewed Jun 25, 2025
View reviewed changes

Comment threadsrc/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m Outdated

Ahmet Ibrahim Aksoyand others added 2 commits June 25, 2025 13:48

Update src/native/libs/System.Net.Security.Native.Apple/pal_networkfr…
3defe85
…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into network_framework_integration_native_interop
57a7069

vitek-karas requested a review from simonrozsival June 25, 2025 11:53

liveans requested review from filipnavara and simonrozsival and removed request for simonrozsival June 25, 2025 11:53

teo-tsirpanis reviewed Jun 25, 2025
View reviewed changes

Comment threadsrc/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt Outdated

rzikm reviewed Jun 25, 2025
View reviewed changes

Ahmet İbrahim Aksoy added 2 commits June 25, 2025 15:54

Fix PlatformManifestFileEntry
c1a2b6b

Review feedback
0977679

This was referenced Jun 25, 2025
browser-wasm Windows build error #116746
Closed
wasm build failure in CI #117017
Closed
Build on Windows Fails sometimes with fatal error C1090: PDB API call failed #48070
Open

Ahmet İbrahim Aksoy added 3 commits June 28, 2025 15:05

Further review feedback
25b8950

Add new library name to nativeaot build target file
91238c5

Merge branch 'main' into network_framework_integration_native_interop
a250b67

teo-tsirpanis added area-System.Net.Security and removed needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Jun 28, 2025

wfurt reviewed Jul 1, 2025
View reviewed changes

vcsjones reviewed Jul 1, 2025
View reviewed changes

rzikm added 6 commits July 1, 2025 14:09

Merge System.Net.Security.Native.Apple with System.Security.Cryptogra…
beb5f93
…phy.Native.Apple

fixup! Merge System.Net.Security.Native.Apple with System.Security.Cr…
0ab06b2
…yptography.Native.Apple

Shared OSStatus
39bef6d

Correctly release some handles
8267454

Remove printf
4bf6eb9

Add comments
f771ea9

rzikm requested a review from wfurt July 1, 2025 13:48

rzikm self-assigned this Jul 2, 2025

Fix build
6ab3942

build-analysisBot mentioned this pull request Jul 2, 2025
Unable to pull image from mcr.microsoft.com #117164
Closed

Merge branch 'main' into network_framework_integration_native_interop
cc950a1

build-analysisBot mentioned this pull request Jul 7, 2025
"We stopped hearing from agent Azure Pipelines 32. Verify the agent machine is running and has a healthy network connection" dotnet/dnceng#1886
Open
3 tasks

rzikm mentioned this pull request Jul 8, 2025
Client-side TLS 1.3 support on OSX #117428
Merged

liveans closed this Jul 8, 2025

github-actionsBot locked and limited conversation to collaborators Aug 8, 2025