Add SslStream.NegotiatedCipherSuite #28527
Description
Spin off from: https://github.com/dotnet/corefx/issues/33809 - currently we do not have agreement on how cipher suite policy should look like, this part of the feature is fairly stable and unlikely to change - regardless of how that API will look like we will need to test it and be able to provide some correct information on what exactly happened during negotiation.
Current APIs on SslStream reports MAC, key exchange and cipher but they don't work well with TLS 1.3 and with AEAD ciphers (MAC is calculated together with ciphertext) and on some platforms like OSX or Linux they do not always work correctly or report None for some of the values.
Adding this API will allow us to directly use value reported by the underlying implementation and tell correctly what the implementation did.
namespace System.Net.Security {
public partial class SslStream {
[CLSCompliantAttribute(false)]
public virtual System.Net.Security.TlsCipherSuite? NegotiatedCipherSuite { get { throw null; } }
}
[CLSCompliant(false)]
public enum TlsCipherSuite : ushort
{
// reasons for using underscores and not following conventions:
// - i.e. TLS_RSA_EXPORT_WITH_RC4_40_MD5 - 2 numbers next to each other - there must be some separator
// - this is what IANA calls them - much easier to find considering how many values there are - having to translate between .NET <==> IANA name will be inconvenient
TLS_NULL_WITH_NULL_NULL = 0x0000,
TLS_RSA_WITH_NULL_MD5 = 0x0001,
TLS_RSA_WITH_NULL_SHA = 0x0002,
TLS_RSA_EXPORT_WITH_RC4_40_MD5 = 0x0003,
TLS_RSA_WITH_RC4_128_MD5 = 0x0004,
TLS_RSA_WITH_RC4_128_SHA = 0x0005,
TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 = 0x0006,
TLS_RSA_WITH_IDEA_CBC_SHA = 0x0007,
TLS_RSA_EXPORT_WITH_DES40_CBC_SHA = 0x0008,
// ... (300 more values from IANA registry)
}
}