Skip to content

support for SSLv2 should be removed from SslStream #35942

@wfurt

Description

@wfurt

RFC 6176 Prohibiting Secure Sockets Layer (SSL) Version 2.0, March 2011.
Unlike obsolete Sslv3 (and TLS1.0/1.0), Sslv2 should be forbidden.

Right now SslStream can support Sslv2 if underlying OS supports it.
At the moment, that seems to be only old versions of Windows.
While OpenSSL 1.0 could support it, all supported distributions are built without it. (Ubuntu16)

This maters as SslStream has craft and state handling to support v2 beyond SslProtocols.Ssl2 enum.
Perhaps we should strip it if passed in and throw PNSP if that is only protocol requested.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-System.Net.Securitybreaking-changeIssue or PR that represents a breaking API or functional change over a previous release.enhancementProduct code improvement that does NOT require public API changes/additions

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions