AndroidClientHandler TLS 1.1 and 1.2 support on Android 4.1 to 4.4

[leonluc-dev]

Currently the AndroidClientHandler only supports TLS 1.1 and TLS 1.2 on API Level 20 or up.

However, the SslSocket instances that Java.Net.HttpURLConnection (and by extension AndroidClientHandler) utilizes do have support for TLS 1.1 and 1.2, but they are disabled by default on API Level 16 to 19 (Android 4.1 to 4.4).

This is shown in the following screenshot when such a socket is examined during runtime on Android 4.1 to 4.4 (screenshot is API Level 17/Android 4.2):

Currently I solved this by subclassing AndroidClientHandler and implementing a custom SSLSocketFactory that builts upon the default implementation.

using Javax.Net.Ssl;
using Xamarin.Android.Net;

namespace MyAndroidApp.HelperClasses
{
    public class MyAndroidClientHandler : AndroidClientHandler
    {
        TlsSSLSocketFactory _customTlsSSLSocketFactory = new TlsSSLSocketFactory();
        protected override System.Threading.Tasks.Task SetupRequest(System.Net.Http.HttpRequestMessage request, Java.Net.HttpURLConnection conn)
        {
            if (conn is HttpsURLConnection sslConn)
            {
                if (Android.OS.Build.VERSION.SdkInt < Android.OS.BuildVersionCodes.Lollipop)
                    //Enable support for TLS v1.2 through custom TLS socketfactory
                    sslConn.SSLSocketFactory = _customTlsSSLSocketFactory;
            }
            return base.SetupRequest(request, conn);
        }


        private class TlsSSLSocketFactory : SSLSocketFactory
        {
            readonly SSLSocketFactory factory = (SSLSocketFactory)Default;

            public override string[] GetDefaultCipherSuites()
            {
                return factory.GetDefaultCipherSuites();
            }

            public override string[] GetSupportedCipherSuites()
            {
                return factory.GetSupportedCipherSuites();
            }
            public override Java.Net.Socket CreateSocket(Java.Net.InetAddress address, int port, Java.Net.InetAddress localAddress, int localPort)
            {
                return EnableTlsOnSocket(factory.CreateSocket(address, port, localAddress, localPort));
            }

            public override Java.Net.Socket CreateSocket(Java.Net.InetAddress host, int port)
            {
                return EnableTlsOnSocket(factory.CreateSocket(host, port));
            }

            public override Java.Net.Socket CreateSocket(string host, int port, Java.Net.InetAddress localHost, int localPort)
            {
                return EnableTlsOnSocket(factory.CreateSocket(host, port, localHost, localPort));
            }

            public override Java.Net.Socket CreateSocket(string host, int port)
            {
                return EnableTlsOnSocket(factory.CreateSocket(host, port));
            }

            public override Java.Net.Socket CreateSocket(Java.Net.Socket s, string host, int port, bool autoClose)
            {
                return EnableTlsOnSocket(factory.CreateSocket(s, host, port, autoClose));
            }

            public override Java.Net.Socket CreateSocket()
            {
                return EnableTlsOnSocket(factory.CreateSocket());
            }

            private Java.Net.Socket EnableTlsOnSocket(Java.Net.Socket socket)
            {
                if(socket != null && (socket is SSLSocket sslSocket))
                {
                    sslSocket.SetEnabledProtocols(sslSocket.GetSupportedProtocols());
                }
                return socket;
            }

           protected override void Dispose(bool disposing)
           {
                factory.Dispose();
                base.Dispose(disposing);
           }
        }
    }

}

It's based on a solution originally provided for ModernHttpClient
This allows the AndroidClientHandler to support TLS 1.1 and TLS 1.2 on pre-API 20 Android versions.

Does this solution have any major caveats to it, or could this possibly be implemented in AndroidClientHandler itself?

[grendello]

PR incorporating the code from OP is up, thanks @gameleon-dev!

[grendello]

Fixed in: d8f1783