Client-side TLS 1.3 support on OSX by rzikm · Pull Request #117428 · dotnet/runtime

rzikm · 2025-07-08T17:37:57Z

The goal is to integrate the new NetworkFramework to support client-side TLS 1.3 on OSX to unblock developers working on OSX. The feature is gated behind one of the following

System.Net.Security.UseNetworkFramework AppCtx switch
DOTNET_SYSTEM_NET_SECURITY_USENETWORKFRAMEWORK environment variable

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Stephen Toub <stoub@microsoft.com>

Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com>

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-14T15:30:46Z

Removing WIP status as we are getting stable. The target is to merge this PR before the end of week

Copilot

Pull Request Overview

Integrates Network.framework for client-side TLS 1.3 on macOS, selectable via an AppContext switch or environment variable

Link the Network framework in build scripts (CMake, MSBuild, extra_libs.cmake)
Introduce a pal_networkframework native module and wire it up through new C# PAL types (SafeDeleteNwContext, interop)
Extend SslStream to choose between SecureTransport and Network.framework paths and update functional tests to skip or adapt when using Network.framework

Reviewed Changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link Network framework for library builds
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Network framework for app builder
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Network framework in library mode
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.h	Change hostname-match API to accept a `SecTrustRef`
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.c	Adapt hostname-match implementation to use the passed-in trust
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m	Add Network.framework–based TLS I/O implementation
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.h	Declare PAL APIs for Network.framework
src/native/libs/System.Security.Cryptography.Native.Apple/extra_libs.cmake	Include Network library in extra linking
src/native/libs/System.Security.Cryptography.Native.Apple/entrypoints.c	Export new Network.framework entry points
src/native/libs/System.Security.Cryptography.Native.Apple/CMakeLists.txt	Add `pal_networkframework.m` to native sources
src/mono/msbuild/apple/build/AppleBuild.targets	Link Network framework in Mono MSBuild targets
src/libraries/System.Net.Security/tests/FunctionalTests/*.cs	Update tests to skip or adapt when Network.framework is enabled
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs	Expose custom-alert capability on Windows
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Unix.cs	Expose custom-alert capability on Unix
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs	Extend PAL to detect and route to Network.framework contexts
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Android.cs	Expose custom-alert capability on Android
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Add gating logic and async context selection
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs	Support async read/write via Network.framework context
src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.OSX.cs	Handle connection info for both PAL contexts
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs	Refactor status codes to use `Interop.AppleCrypto.OSStatus`
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteNwContext.cs	Implement `SafeDeleteNwContext` for Network.framework
src/libraries/System.Net.Security/src/System/Net/Security/Pal.Managed/SslProtocolsValidation.cs	Change ValidateContiguous to accept `ReadOnlySpan<SslProtocols>`
src/libraries/System.Net.Security/src/System/Net/CertificateValidationPal.OSX.cs	Use `SecTrustRef` for hostname validation in both contexts
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Define `TARGET_APPLE` and include new interop files
src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs	Add detection for Network.framework and TLS 1.3 client/server support
src/libraries/Common/src/System/Net/ReadWriteAdapter.cs	Extend `IReadWriteAdapter` with `Task`/`ValueTask` overloads
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Ssl.cs	Update p/invoke for the new hostname-match signature
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.OSStatus.cs	Add `OSStatus` constants for native error mapping
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.cs	Declare basic Network.framework interop and error handling
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.Tls.cs	Declare TLS entry points for the Network.framework shim
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Add `NetworkFramework` library constant
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Link Network framework in NativeAOT Unix builds

Comments suppressed due to low confidence (2)

src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m:1

The new Network.framework integration layer is extensive but currently has no direct unit or functional tests; adding tests for handshake, send/receive, and error paths on macOS would help validate this feature.

// Licensed to the .NET Foundation under one or more agreements.

src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs:4

The using directives for System.IO, System.Threading, and System.Threading.Tasks appear unused in this file; consider removing them to reduce clutter.

using System.IO;

Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…OSX/SafeDeleteNwContext.cs Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…networkframework.m Co-authored-by: Adeel Mujahid <3840695+am11@users.noreply.github.com>

wfurt

LGTM. this is big milestone.

rzikm · 2025-07-17T15:31:33Z

/ba-g WASM failures are unrelated, linux failures are unrelated

rzikm · 2025-07-08T17:37:57Z

Replaces #117016.

The goal is to integrate the new NetworkFramework to support client-side TLS 1.3 on OSX to unblock developers working on OSX. The feature is gated behind one of the following

System.Net.Security.UseNetworkFramework AppCtx switch
DOTNET_SYSTEM_NET_SECURITY_USENETWORKFRAMEWORK environment variable

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Stephen Toub <stoub@microsoft.com>

Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com>

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-14T15:30:46Z

Removing WIP status as we are getting stable. The target is to merge this PR before the end of week

Copilot

Pull Request Overview

Integrates Network.framework for client-side TLS 1.3 on macOS, selectable via an AppContext switch or environment variable

Link the Network framework in build scripts (CMake, MSBuild, extra_libs.cmake)
Introduce a pal_networkframework native module and wire it up through new C# PAL types (SafeDeleteNwContext, interop)
Extend SslStream to choose between SecureTransport and Network.framework paths and update functional tests to skip or adapt when using Network.framework

Reviewed Changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link Network framework for library builds
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Network framework for app builder
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Network framework in library mode
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.h	Change hostname-match API to accept a `SecTrustRef`
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.c	Adapt hostname-match implementation to use the passed-in trust
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m	Add Network.framework–based TLS I/O implementation
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.h	Declare PAL APIs for Network.framework
src/native/libs/System.Security.Cryptography.Native.Apple/extra_libs.cmake	Include Network library in extra linking
src/native/libs/System.Security.Cryptography.Native.Apple/entrypoints.c	Export new Network.framework entry points
src/native/libs/System.Security.Cryptography.Native.Apple/CMakeLists.txt	Add `pal_networkframework.m` to native sources
src/mono/msbuild/apple/build/AppleBuild.targets	Link Network framework in Mono MSBuild targets
src/libraries/System.Net.Security/tests/FunctionalTests/*.cs	Update tests to skip or adapt when Network.framework is enabled
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs	Expose custom-alert capability on Windows
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Unix.cs	Expose custom-alert capability on Unix
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs	Extend PAL to detect and route to Network.framework contexts
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Android.cs	Expose custom-alert capability on Android
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Add gating logic and async context selection
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs	Support async read/write via Network.framework context
src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.OSX.cs	Handle connection info for both PAL contexts
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs	Refactor status codes to use `Interop.AppleCrypto.OSStatus`
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteNwContext.cs	Implement `SafeDeleteNwContext` for Network.framework
src/libraries/System.Net.Security/src/System/Net/Security/Pal.Managed/SslProtocolsValidation.cs	Change ValidateContiguous to accept `ReadOnlySpan<SslProtocols>`
src/libraries/System.Net.Security/src/System/Net/CertificateValidationPal.OSX.cs	Use `SecTrustRef` for hostname validation in both contexts
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Define `TARGET_APPLE` and include new interop files
src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs	Add detection for Network.framework and TLS 1.3 client/server support
src/libraries/Common/src/System/Net/ReadWriteAdapter.cs	Extend `IReadWriteAdapter` with `Task`/`ValueTask` overloads
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Ssl.cs	Update p/invoke for the new hostname-match signature
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.OSStatus.cs	Add `OSStatus` constants for native error mapping
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.cs	Declare basic Network.framework interop and error handling
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.Tls.cs	Declare TLS entry points for the Network.framework shim
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Add `NetworkFramework` library constant
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Link Network framework in NativeAOT Unix builds

Comments suppressed due to low confidence (2)

src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m:1

The new Network.framework integration layer is extensive but currently has no direct unit or functional tests; adding tests for handshake, send/receive, and error paths on macOS would help validate this feature.

// Licensed to the .NET Foundation under one or more agreements.

src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs:4

The using directives for System.IO, System.Threading, and System.Threading.Tasks appear unused in this file; consider removing them to reduce clutter.

using System.IO;

Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…OSX/SafeDeleteNwContext.cs Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…networkframework.m Co-authored-by: Adeel Mujahid <3840695+am11@users.noreply.github.com>

wfurt

LGTM. this is big milestone.

rzikm · 2025-07-17T15:31:33Z

/ba-g WASM failures are unrelated, linux failures are unrelated

rzikm · 2025-07-08T17:37:57Z

Replaces #117016.

The goal is to integrate the new NetworkFramework to support client-side TLS 1.3 on OSX to unblock developers working on OSX. The feature is gated behind one of the following

System.Net.Security.UseNetworkFramework AppCtx switch
DOTNET_SYSTEM_NET_SECURITY_USENETWORKFRAMEWORK environment variable

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Stephen Toub <stoub@microsoft.com>

Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com>

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-14T15:30:46Z

Removing WIP status as we are getting stable. The target is to merge this PR before the end of week

Copilot

Pull Request Overview

Integrates Network.framework for client-side TLS 1.3 on macOS, selectable via an AppContext switch or environment variable

Link the Network framework in build scripts (CMake, MSBuild, extra_libs.cmake)
Introduce a pal_networkframework native module and wire it up through new C# PAL types (SafeDeleteNwContext, interop)
Extend SslStream to choose between SecureTransport and Network.framework paths and update functional tests to skip or adapt when using Network.framework

Reviewed Changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link Network framework for library builds
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Network framework for app builder
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Network framework in library mode
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.h	Change hostname-match API to accept a `SecTrustRef`
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.c	Adapt hostname-match implementation to use the passed-in trust
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m	Add Network.framework–based TLS I/O implementation
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.h	Declare PAL APIs for Network.framework
src/native/libs/System.Security.Cryptography.Native.Apple/extra_libs.cmake	Include Network library in extra linking
src/native/libs/System.Security.Cryptography.Native.Apple/entrypoints.c	Export new Network.framework entry points
src/native/libs/System.Security.Cryptography.Native.Apple/CMakeLists.txt	Add `pal_networkframework.m` to native sources
src/mono/msbuild/apple/build/AppleBuild.targets	Link Network framework in Mono MSBuild targets
src/libraries/System.Net.Security/tests/FunctionalTests/*.cs	Update tests to skip or adapt when Network.framework is enabled
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs	Expose custom-alert capability on Windows
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Unix.cs	Expose custom-alert capability on Unix
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs	Extend PAL to detect and route to Network.framework contexts
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Android.cs	Expose custom-alert capability on Android
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Add gating logic and async context selection
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs	Support async read/write via Network.framework context
src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.OSX.cs	Handle connection info for both PAL contexts
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs	Refactor status codes to use `Interop.AppleCrypto.OSStatus`
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteNwContext.cs	Implement `SafeDeleteNwContext` for Network.framework
src/libraries/System.Net.Security/src/System/Net/Security/Pal.Managed/SslProtocolsValidation.cs	Change ValidateContiguous to accept `ReadOnlySpan<SslProtocols>`
src/libraries/System.Net.Security/src/System/Net/CertificateValidationPal.OSX.cs	Use `SecTrustRef` for hostname validation in both contexts
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Define `TARGET_APPLE` and include new interop files
src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs	Add detection for Network.framework and TLS 1.3 client/server support
src/libraries/Common/src/System/Net/ReadWriteAdapter.cs	Extend `IReadWriteAdapter` with `Task`/`ValueTask` overloads
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Ssl.cs	Update p/invoke for the new hostname-match signature
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.OSStatus.cs	Add `OSStatus` constants for native error mapping
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.cs	Declare basic Network.framework interop and error handling
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.Tls.cs	Declare TLS entry points for the Network.framework shim
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Add `NetworkFramework` library constant
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Link Network framework in NativeAOT Unix builds

Comments suppressed due to low confidence (2)

src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m:1

The new Network.framework integration layer is extensive but currently has no direct unit or functional tests; adding tests for handshake, send/receive, and error paths on macOS would help validate this feature.

// Licensed to the .NET Foundation under one or more agreements.

src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs:4

The using directives for System.IO, System.Threading, and System.Threading.Tasks appear unused in this file; consider removing them to reduce clutter.

using System.IO;

Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…OSX/SafeDeleteNwContext.cs Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…networkframework.m Co-authored-by: Adeel Mujahid <3840695+am11@users.noreply.github.com>

wfurt

LGTM. this is big milestone.

rzikm · 2025-07-17T15:31:33Z

/ba-g WASM failures are unrelated, linux failures are unrelated

rzikm · 2025-07-08T17:37:57Z

Replaces #117016.

The goal is to integrate the new NetworkFramework to support client-side TLS 1.3 on OSX to unblock developers working on OSX. The feature is gated behind one of the following

System.Net.Security.UseNetworkFramework AppCtx switch
DOTNET_SYSTEM_NET_SECURITY_USENETWORKFRAMEWORK environment variable

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Stephen Toub <stoub@microsoft.com>

Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com>

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-14T15:30:46Z

Removing WIP status as we are getting stable. The target is to merge this PR before the end of week

Copilot

Pull Request Overview

Integrates Network.framework for client-side TLS 1.3 on macOS, selectable via an AppContext switch or environment variable

Link the Network framework in build scripts (CMake, MSBuild, extra_libs.cmake)
Introduce a pal_networkframework native module and wire it up through new C# PAL types (SafeDeleteNwContext, interop)
Extend SslStream to choose between SecureTransport and Network.framework paths and update functional tests to skip or adapt when using Network.framework

Reviewed Changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link Network framework for library builds
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Network framework for app builder
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Network framework in library mode
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.h	Change hostname-match API to accept a `SecTrustRef`
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.c	Adapt hostname-match implementation to use the passed-in trust
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m	Add Network.framework–based TLS I/O implementation
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.h	Declare PAL APIs for Network.framework
src/native/libs/System.Security.Cryptography.Native.Apple/extra_libs.cmake	Include Network library in extra linking
src/native/libs/System.Security.Cryptography.Native.Apple/entrypoints.c	Export new Network.framework entry points
src/native/libs/System.Security.Cryptography.Native.Apple/CMakeLists.txt	Add `pal_networkframework.m` to native sources
src/mono/msbuild/apple/build/AppleBuild.targets	Link Network framework in Mono MSBuild targets
src/libraries/System.Net.Security/tests/FunctionalTests/*.cs	Update tests to skip or adapt when Network.framework is enabled
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs	Expose custom-alert capability on Windows
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Unix.cs	Expose custom-alert capability on Unix
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs	Extend PAL to detect and route to Network.framework contexts
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Android.cs	Expose custom-alert capability on Android
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Add gating logic and async context selection
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs	Support async read/write via Network.framework context
src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.OSX.cs	Handle connection info for both PAL contexts
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs	Refactor status codes to use `Interop.AppleCrypto.OSStatus`
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteNwContext.cs	Implement `SafeDeleteNwContext` for Network.framework
src/libraries/System.Net.Security/src/System/Net/Security/Pal.Managed/SslProtocolsValidation.cs	Change ValidateContiguous to accept `ReadOnlySpan<SslProtocols>`
src/libraries/System.Net.Security/src/System/Net/CertificateValidationPal.OSX.cs	Use `SecTrustRef` for hostname validation in both contexts
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Define `TARGET_APPLE` and include new interop files
src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs	Add detection for Network.framework and TLS 1.3 client/server support
src/libraries/Common/src/System/Net/ReadWriteAdapter.cs	Extend `IReadWriteAdapter` with `Task`/`ValueTask` overloads
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Ssl.cs	Update p/invoke for the new hostname-match signature
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.OSStatus.cs	Add `OSStatus` constants for native error mapping
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.cs	Declare basic Network.framework interop and error handling
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.Tls.cs	Declare TLS entry points for the Network.framework shim
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Add `NetworkFramework` library constant
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Link Network framework in NativeAOT Unix builds

Comments suppressed due to low confidence (2)

src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m:1

The new Network.framework integration layer is extensive but currently has no direct unit or functional tests; adding tests for handshake, send/receive, and error paths on macOS would help validate this feature.

// Licensed to the .NET Foundation under one or more agreements.

src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs:4

The using directives for System.IO, System.Threading, and System.Threading.Tasks appear unused in this file; consider removing them to reduce clutter.

using System.IO;

Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…OSX/SafeDeleteNwContext.cs Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…networkframework.m Co-authored-by: Adeel Mujahid <3840695+am11@users.noreply.github.com>

wfurt

LGTM. this is big milestone.

rzikm · 2025-07-17T15:31:33Z

/ba-g WASM failures are unrelated, linux failures are unrelated

rzikm · 2025-07-08T17:37:57Z

Replaces #117016.

The goal is to integrate the new NetworkFramework to support client-side TLS 1.3 on OSX to unblock developers working on OSX. The feature is gated behind one of the following

System.Net.Security.UseNetworkFramework AppCtx switch
DOTNET_SYSTEM_NET_SECURITY_USENETWORKFRAMEWORK environment variable

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Stephen Toub <stoub@microsoft.com>

Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com>

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-14T15:30:46Z

Removing WIP status as we are getting stable. The target is to merge this PR before the end of week

Copilot

Pull Request Overview

Integrates Network.framework for client-side TLS 1.3 on macOS, selectable via an AppContext switch or environment variable

Link the Network framework in build scripts (CMake, MSBuild, extra_libs.cmake)
Introduce a pal_networkframework native module and wire it up through new C# PAL types (SafeDeleteNwContext, interop)
Extend SslStream to choose between SecureTransport and Network.framework paths and update functional tests to skip or adapt when using Network.framework

Reviewed Changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link Network framework for library builds
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Network framework for app builder
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Network framework in library mode
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.h	Change hostname-match API to accept a `SecTrustRef`
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.c	Adapt hostname-match implementation to use the passed-in trust
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m	Add Network.framework–based TLS I/O implementation
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.h	Declare PAL APIs for Network.framework
src/native/libs/System.Security.Cryptography.Native.Apple/extra_libs.cmake	Include Network library in extra linking
src/native/libs/System.Security.Cryptography.Native.Apple/entrypoints.c	Export new Network.framework entry points
src/native/libs/System.Security.Cryptography.Native.Apple/CMakeLists.txt	Add `pal_networkframework.m` to native sources
src/mono/msbuild/apple/build/AppleBuild.targets	Link Network framework in Mono MSBuild targets
src/libraries/System.Net.Security/tests/FunctionalTests/*.cs	Update tests to skip or adapt when Network.framework is enabled
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs	Expose custom-alert capability on Windows
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Unix.cs	Expose custom-alert capability on Unix
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs	Extend PAL to detect and route to Network.framework contexts
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Android.cs	Expose custom-alert capability on Android
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Add gating logic and async context selection
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs	Support async read/write via Network.framework context
src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.OSX.cs	Handle connection info for both PAL contexts
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs	Refactor status codes to use `Interop.AppleCrypto.OSStatus`
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteNwContext.cs	Implement `SafeDeleteNwContext` for Network.framework
src/libraries/System.Net.Security/src/System/Net/Security/Pal.Managed/SslProtocolsValidation.cs	Change ValidateContiguous to accept `ReadOnlySpan<SslProtocols>`
src/libraries/System.Net.Security/src/System/Net/CertificateValidationPal.OSX.cs	Use `SecTrustRef` for hostname validation in both contexts
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Define `TARGET_APPLE` and include new interop files
src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs	Add detection for Network.framework and TLS 1.3 client/server support
src/libraries/Common/src/System/Net/ReadWriteAdapter.cs	Extend `IReadWriteAdapter` with `Task`/`ValueTask` overloads
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Ssl.cs	Update p/invoke for the new hostname-match signature
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.OSStatus.cs	Add `OSStatus` constants for native error mapping
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.cs	Declare basic Network.framework interop and error handling
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.Tls.cs	Declare TLS entry points for the Network.framework shim
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Add `NetworkFramework` library constant
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Link Network framework in NativeAOT Unix builds

Comments suppressed due to low confidence (2)

src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m:1

The new Network.framework integration layer is extensive but currently has no direct unit or functional tests; adding tests for handshake, send/receive, and error paths on macOS would help validate this feature.

// Licensed to the .NET Foundation under one or more agreements.

src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs:4

The using directives for System.IO, System.Threading, and System.Threading.Tasks appear unused in this file; consider removing them to reduce clutter.

using System.IO;

Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…OSX/SafeDeleteNwContext.cs Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…networkframework.m Co-authored-by: Adeel Mujahid <3840695+am11@users.noreply.github.com>

wfurt

LGTM. this is big milestone.

rzikm · 2025-07-17T15:31:33Z

/ba-g WASM failures are unrelated, linux failures are unrelated

rzikm · 2025-07-08T17:37:57Z

Replaces #117016.

The goal is to integrate the new NetworkFramework to support client-side TLS 1.3 on OSX to unblock developers working on OSX. The feature is gated behind one of the following

System.Net.Security.UseNetworkFramework AppCtx switch
DOTNET_SYSTEM_NET_SECURITY_USENETWORKFRAMEWORK environment variable

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Stephen Toub <stoub@microsoft.com>

Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com>

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-14T15:30:46Z

Removing WIP status as we are getting stable. The target is to merge this PR before the end of week

Copilot

Pull Request Overview

Integrates Network.framework for client-side TLS 1.3 on macOS, selectable via an AppContext switch or environment variable

Link the Network framework in build scripts (CMake, MSBuild, extra_libs.cmake)
Introduce a pal_networkframework native module and wire it up through new C# PAL types (SafeDeleteNwContext, interop)
Extend SslStream to choose between SecureTransport and Network.framework paths and update functional tests to skip or adapt when using Network.framework

Reviewed Changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link Network framework for library builds
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Network framework for app builder
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Network framework in library mode
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.h	Change hostname-match API to accept a `SecTrustRef`
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.c	Adapt hostname-match implementation to use the passed-in trust
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m	Add Network.framework–based TLS I/O implementation
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.h	Declare PAL APIs for Network.framework
src/native/libs/System.Security.Cryptography.Native.Apple/extra_libs.cmake	Include Network library in extra linking
src/native/libs/System.Security.Cryptography.Native.Apple/entrypoints.c	Export new Network.framework entry points
src/native/libs/System.Security.Cryptography.Native.Apple/CMakeLists.txt	Add `pal_networkframework.m` to native sources
src/mono/msbuild/apple/build/AppleBuild.targets	Link Network framework in Mono MSBuild targets
src/libraries/System.Net.Security/tests/FunctionalTests/*.cs	Update tests to skip or adapt when Network.framework is enabled
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs	Expose custom-alert capability on Windows
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Unix.cs	Expose custom-alert capability on Unix
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs	Extend PAL to detect and route to Network.framework contexts
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Android.cs	Expose custom-alert capability on Android
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Add gating logic and async context selection
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs	Support async read/write via Network.framework context
src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.OSX.cs	Handle connection info for both PAL contexts
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs	Refactor status codes to use `Interop.AppleCrypto.OSStatus`
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteNwContext.cs	Implement `SafeDeleteNwContext` for Network.framework
src/libraries/System.Net.Security/src/System/Net/Security/Pal.Managed/SslProtocolsValidation.cs	Change ValidateContiguous to accept `ReadOnlySpan<SslProtocols>`
src/libraries/System.Net.Security/src/System/Net/CertificateValidationPal.OSX.cs	Use `SecTrustRef` for hostname validation in both contexts
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Define `TARGET_APPLE` and include new interop files
src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs	Add detection for Network.framework and TLS 1.3 client/server support
src/libraries/Common/src/System/Net/ReadWriteAdapter.cs	Extend `IReadWriteAdapter` with `Task`/`ValueTask` overloads
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Ssl.cs	Update p/invoke for the new hostname-match signature
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.OSStatus.cs	Add `OSStatus` constants for native error mapping
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.cs	Declare basic Network.framework interop and error handling
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.Tls.cs	Declare TLS entry points for the Network.framework shim
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Add `NetworkFramework` library constant
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Link Network framework in NativeAOT Unix builds

Comments suppressed due to low confidence (2)

src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m:1

The new Network.framework integration layer is extensive but currently has no direct unit or functional tests; adding tests for handshake, send/receive, and error paths on macOS would help validate this feature.

// Licensed to the .NET Foundation under one or more agreements.

src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs:4

The using directives for System.IO, System.Threading, and System.Threading.Tasks appear unused in this file; consider removing them to reduce clutter.

using System.IO;

Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…OSX/SafeDeleteNwContext.cs Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…networkframework.m Co-authored-by: Adeel Mujahid <3840695+am11@users.noreply.github.com>

wfurt

LGTM. this is big milestone.

rzikm · 2025-07-17T15:31:33Z

/ba-g WASM failures are unrelated, linux failures are unrelated

rzikm · 2025-07-08T17:37:57Z

Replaces #117016.

The goal is to integrate the new NetworkFramework to support client-side TLS 1.3 on OSX to unblock developers working on OSX. The feature is gated behind one of the following

System.Net.Security.UseNetworkFramework AppCtx switch
DOTNET_SYSTEM_NET_SECURITY_USENETWORKFRAMEWORK environment variable

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Stephen Toub <stoub@microsoft.com>

Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com>

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-14T15:30:46Z

Removing WIP status as we are getting stable. The target is to merge this PR before the end of week

Copilot

Pull Request Overview

Integrates Network.framework for client-side TLS 1.3 on macOS, selectable via an AppContext switch or environment variable

Link the Network framework in build scripts (CMake, MSBuild, extra_libs.cmake)
Introduce a pal_networkframework native module and wire it up through new C# PAL types (SafeDeleteNwContext, interop)
Extend SslStream to choose between SecureTransport and Network.framework paths and update functional tests to skip or adapt when using Network.framework

Reviewed Changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link Network framework for library builds
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Network framework for app builder
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Network framework in library mode
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.h	Change hostname-match API to accept a `SecTrustRef`
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.c	Adapt hostname-match implementation to use the passed-in trust
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m	Add Network.framework–based TLS I/O implementation
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.h	Declare PAL APIs for Network.framework
src/native/libs/System.Security.Cryptography.Native.Apple/extra_libs.cmake	Include Network library in extra linking
src/native/libs/System.Security.Cryptography.Native.Apple/entrypoints.c	Export new Network.framework entry points
src/native/libs/System.Security.Cryptography.Native.Apple/CMakeLists.txt	Add `pal_networkframework.m` to native sources
src/mono/msbuild/apple/build/AppleBuild.targets	Link Network framework in Mono MSBuild targets
src/libraries/System.Net.Security/tests/FunctionalTests/*.cs	Update tests to skip or adapt when Network.framework is enabled
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs	Expose custom-alert capability on Windows
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Unix.cs	Expose custom-alert capability on Unix
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs	Extend PAL to detect and route to Network.framework contexts
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Android.cs	Expose custom-alert capability on Android
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Add gating logic and async context selection
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs	Support async read/write via Network.framework context
src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.OSX.cs	Handle connection info for both PAL contexts
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs	Refactor status codes to use `Interop.AppleCrypto.OSStatus`
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteNwContext.cs	Implement `SafeDeleteNwContext` for Network.framework
src/libraries/System.Net.Security/src/System/Net/Security/Pal.Managed/SslProtocolsValidation.cs	Change ValidateContiguous to accept `ReadOnlySpan<SslProtocols>`
src/libraries/System.Net.Security/src/System/Net/CertificateValidationPal.OSX.cs	Use `SecTrustRef` for hostname validation in both contexts
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Define `TARGET_APPLE` and include new interop files
src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs	Add detection for Network.framework and TLS 1.3 client/server support
src/libraries/Common/src/System/Net/ReadWriteAdapter.cs	Extend `IReadWriteAdapter` with `Task`/`ValueTask` overloads
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Ssl.cs	Update p/invoke for the new hostname-match signature
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.OSStatus.cs	Add `OSStatus` constants for native error mapping
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.cs	Declare basic Network.framework interop and error handling
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.Tls.cs	Declare TLS entry points for the Network.framework shim
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Add `NetworkFramework` library constant
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Link Network framework in NativeAOT Unix builds

Comments suppressed due to low confidence (2)

src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m:1

The new Network.framework integration layer is extensive but currently has no direct unit or functional tests; adding tests for handshake, send/receive, and error paths on macOS would help validate this feature.

// Licensed to the .NET Foundation under one or more agreements.

src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs:4

The using directives for System.IO, System.Threading, and System.Threading.Tasks appear unused in this file; consider removing them to reduce clutter.

using System.IO;

Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…OSX/SafeDeleteNwContext.cs Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…networkframework.m Co-authored-by: Adeel Mujahid <3840695+am11@users.noreply.github.com>

wfurt

LGTM. this is big milestone.

rzikm · 2025-07-17T15:31:33Z

/ba-g WASM failures are unrelated, linux failures are unrelated

rzikm · 2025-07-08T17:37:57Z

Replaces #117016.

The goal is to integrate the new NetworkFramework to support client-side TLS 1.3 on OSX to unblock developers working on OSX. The feature is gated behind one of the following

System.Net.Security.UseNetworkFramework AppCtx switch
DOTNET_SYSTEM_NET_SECURITY_USENETWORKFRAMEWORK environment variable

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Stephen Toub <stoub@microsoft.com>

Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com>

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-14T15:30:46Z

Removing WIP status as we are getting stable. The target is to merge this PR before the end of week

Copilot

Pull Request Overview

Integrates Network.framework for client-side TLS 1.3 on macOS, selectable via an AppContext switch or environment variable

Link the Network framework in build scripts (CMake, MSBuild, extra_libs.cmake)
Introduce a pal_networkframework native module and wire it up through new C# PAL types (SafeDeleteNwContext, interop)
Extend SslStream to choose between SecureTransport and Network.framework paths and update functional tests to skip or adapt when using Network.framework

Reviewed Changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link Network framework for library builds
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Network framework for app builder
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Network framework in library mode
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.h	Change hostname-match API to accept a `SecTrustRef`
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.c	Adapt hostname-match implementation to use the passed-in trust
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m	Add Network.framework–based TLS I/O implementation
src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.h	Declare PAL APIs for Network.framework
src/native/libs/System.Security.Cryptography.Native.Apple/extra_libs.cmake	Include Network library in extra linking
src/native/libs/System.Security.Cryptography.Native.Apple/entrypoints.c	Export new Network.framework entry points
src/native/libs/System.Security.Cryptography.Native.Apple/CMakeLists.txt	Add `pal_networkframework.m` to native sources
src/mono/msbuild/apple/build/AppleBuild.targets	Link Network framework in Mono MSBuild targets
src/libraries/System.Net.Security/tests/FunctionalTests/*.cs	Update tests to skip or adapt when Network.framework is enabled
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs	Expose custom-alert capability on Windows
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Unix.cs	Expose custom-alert capability on Unix
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs	Extend PAL to detect and route to Network.framework contexts
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Android.cs	Expose custom-alert capability on Android
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Add gating logic and async context selection
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs	Support async read/write via Network.framework context
src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.OSX.cs	Handle connection info for both PAL contexts
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs	Refactor status codes to use `Interop.AppleCrypto.OSStatus`
src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteNwContext.cs	Implement `SafeDeleteNwContext` for Network.framework
src/libraries/System.Net.Security/src/System/Net/Security/Pal.Managed/SslProtocolsValidation.cs	Change ValidateContiguous to accept `ReadOnlySpan<SslProtocols>`
src/libraries/System.Net.Security/src/System/Net/CertificateValidationPal.OSX.cs	Use `SecTrustRef` for hostname validation in both contexts
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Define `TARGET_APPLE` and include new interop files
src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs	Add detection for Network.framework and TLS 1.3 client/server support
src/libraries/Common/src/System/Net/ReadWriteAdapter.cs	Extend `IReadWriteAdapter` with `Task`/`ValueTask` overloads
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Ssl.cs	Update p/invoke for the new hostname-match signature
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.OSStatus.cs	Add `OSStatus` constants for native error mapping
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.cs	Declare basic Network.framework interop and error handling
src/libraries/Common/src/Interop/OSX/Interop.NetworkFramework.Tls.cs	Declare TLS entry points for the Network.framework shim
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Add `NetworkFramework` library constant
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Link Network framework in NativeAOT Unix builds

Comments suppressed due to low confidence (2)

src/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m:1

The new Network.framework integration layer is extensive but currently has no direct unit or functional tests; adding tests for handshake, send/receive, and error paths on macOS would help validate this feature.

// Licensed to the .NET Foundation under one or more agreements.

src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs:4

The using directives for System.IO, System.Threading, and System.Threading.Tasks appear unused in this file; consider removing them to reduce clutter.

using System.IO;

Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…OSX/SafeDeleteNwContext.cs Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

…networkframework.m Co-authored-by: Adeel Mujahid <3840695+am11@users.noreply.github.com>

wfurt

LGTM. this is big milestone.

rzikm · 2025-07-17T15:31:33Z

/ba-g WASM failures are unrelated, linux failures are unrelated

Ahmet İbrahim Aksoyand others added 30 commits June 16, 2025 19:54

Native Interop Layer
c062e18

Native Layer Compilation fix for Mono + NativeAOT + templates
ecba3f7

First shape of new native + interop
bf130f3

Newlines at the end of files
0dcc599

Default constructor ownsHandle to true
44b3597

Delete couple of unsafe keyword in Interop
3cbcea7

Update src/native/libs/System.Net.Security.Native.Apple/pal_networkfr…
3defe85
…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into network_framework_integration_native_interop
57a7069

Fix PlatformManifestFileEntry
c1a2b6b

Review feedback
0977679

Apply suggestions from code review
fe343b0
Co-authored-by: Stephen Toub <stoub@microsoft.com>

Update src/libraries/Common/src/Interop/OSX/Interop.Network.Tls.cs
0fff060
Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com>

Review feedbacks
3441093

Merge branch 'main' into network_framework_integration_native_interop
3e547c5

Further review feedback
25b8950

Add new library name to nativeaot build target file
91238c5

Merge branch 'main' into network_framework_integration_native_interop
a250b67

Merge System.Net.Security.Native.Apple with System.Security.Cryptogra…
beb5f93
…phy.Native.Apple

fixup! Merge System.Net.Security.Native.Apple with System.Security.Cr…
0ab06b2
…yptography.Native.Apple

Shared OSStatus
39bef6d

Correctly release some handles
8267454

Remove printf
4bf6eb9

Add comments
f771ea9

Fix build
6ab3942

Copy of initial changes
b05467e

Fix build
9aa167a

WIP
da8d285

WIP
e7fa071

more WIP
d018034

Minimal example is working
4767c77

rzikm requested a review from MichalStrehovsky as a code owner July 14, 2025 15:29

rzikm changed the title ~~[WIP] TLS 1.3 on OSX support~~Client-side TLS 1.3 support on OSXJul 14, 2025

liveans requested a review from Copilot July 14, 2025 15:45

CopilotAI reviewed Jul 14, 2025
View reviewed changes

liveans mentioned this pull request Jul 14, 2025
[WIP] Server-side TLS 1.3 support on OSX PoC rzikm/dotnet-runtime#8
Closed

build-analysisBot mentioned this pull request Jul 15, 2025
/root/helix/work/correlation/scripts/<hash>/execute.sh: Permission denied dotnet/dnceng#3412
Closed
3 tasks

Logging improvements
39582fc

liveans reviewed Jul 15, 2025
View reviewed changes

Comment threadsrc/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m Outdated

build-analysisBot mentioned this pull request Jul 15, 2025
Android tests timing out #117669
Closed

liveans reviewed Jul 16, 2025
View reviewed changes

rzikmand others added 5 commits July 16, 2025 07:03

Merge remote-tracking branch 'upstream/main' into osx-tls13
0d02b54

Apply suggestion from@liveans
a6ff82f
Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

Update src/libraries/System.Net.Security/src/System/Net/Security/Pal.…
8102719
…OSX/SafeDeleteNwContext.cs Co-authored-by: Ahmet Ibrahim Aksoy <aaksoy@microsoft.com>

Code review feecback
a6c124d

Remove duplicate void* state argument in native functions
83bcaf1

am11 reviewed Jul 16, 2025
View reviewed changes

Comment threadsrc/native/libs/System.Security.Cryptography.Native.Apple/pal_networkframework.m Outdated

This was referenced Jul 16, 2025
X509Certificates.Tests.ChainTests.BuildChainCustomTrustStore failure on linux musl #117723
Closed
System.Security.Cryptography.X509Certificates.Tests fails on linux #117724
Closed

Update src/native/libs/System.Security.Cryptography.Native.Apple/pal_…
ba6e3fb
…networkframework.m Co-authored-by: Adeel Mujahid <3840695+am11@users.noreply.github.com>

build-analysisBot mentioned this pull request Jul 17, 2025
System.ComponentModel.Win32Exception : An error occurred trying to start process 'notepad.exe' with working directory 'C:\h\w\9F8D0903\w\B7E309C0\e'. Access is denied #90406
Closed
3 tasks

wfurt approved these changes Jul 17, 2025
View reviewed changes

rzikm merged commit dd263ab into dotnet:mainJul 17, 2025
153 of 160 checks passed

rzikm mentioned this pull request Jul 17, 2025
investigate TLS13 on MacOS #1979
Open

simonrozsival mentioned this pull request Aug 4, 2025
[android] System.Net.Http.Functional.Tests failure with TimeoutException #118118
Closed

liveans mentioned this pull request Aug 5, 2025
Update libraries for preview 7 dotnet/core#10000
Merged

vitek-karas mentioned this pull request Aug 14, 2025
System.Net.Mail.Tests.SmtpClientTlsTest_Send.AuthenticationException_Propagates failure: expected typeof(System.Security.Authentication.AuthenticationException), actual typeof(System.Net.Mail.SmtpException) #117963
Closed

rzikm mentioned this pull request Aug 15, 2025
Restore calls to CreateFatalHandshakeAlertToken on Android #118765
Merged

github-actionsBot locked and limited conversation to collaborators Aug 17, 2025