[Mono-dev] Following up on Mono's new TLS implementation

[Martin Baulig]

Hello,

This is an update on the recent work that we have been doing with Mono’s
TLS transport.   We have landed into mono/master an important improvement
to the TLS support, this email describes what we did.

In the previous release, we manually chose the TLS implementation in a
handful of places (like HttpWebRequest), but this was not pervasive, in
particular, this was not working for SslStream, or any of the SslStream
users, like .NET’s built-in HTTP server, HttpListener.

We now have added the implementation switcher to the SslStream and
HttpListener classes.   The default implementation of SslStream for now
continues to be the old Mono TLS implementation, the one that supports SSL
and up to TLS 1.0.   But it is now possible to switch the implementation to
either our new managed implementation or any implementation built on top of
something else.

You can control this with the MONO_TLS_PROVIDER environment variable.  The
possible settings are as follows:

default - let Mono choose the best implementation available for the
platform, currently this is hardcoded to the old implementation, but we
will change this once we complete the audit of our TLS stack, and we might
change this on a per-platform basis to use SslStream implementations that
use some native library.

Any full typename - You can specify a fully qualified .NET Type, this can
be used to test alternative implementations without changing Mono’s runtime:

MONO_TLS_PROVIDER="Mono.Security.Providers.NewTls.NewTlsProvider,
Mono.Security.Providers.NewTls, Version=4.0.0.0, Culture=neutral,
PublicKeyToken=84e3aee7225169c2"

This type should subclass the Mono.Security.Interface.MonoTlsProvider
interface from the Mono.Security assembly and have a public parameterless
constructor.

oldtls - Mono’s historical implementation, it only goes up to TLS 1.0.

newtls - Mono’s new managed implementation, it supports TLS 1.0 up to 1.2

Enjoy!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ximian.com/pipermail/mono-devel-list/attachments/20151103/ea161074/attachment.html>