[OSX][TLS 1.3] Network Framework Native Layer + Interop Classes Implementations #117016

liveans · 2025-06-25T11:45:39Z

This is the initial part of #1979. Follow-up PRs will handle integration with the PAL layer and the SslStream layer.
I'm splitting the changes into multiple PRs to simplify the review process.

And this PR starting to replace #104835 PoC PR, most of the parts are untouched and directly copy from that PR. Mostly restructured stuff into different library + different interop file.

I'm going to iterate feature progressively, once we merge this, I'm going to create the next PR for PAL + SslStream integration layer.

Copilot

Pull Request Overview

Initial implementation of a native Network Framework layer and corresponding managed interop code to support TLS 1.3 on macOS.

Updated build scripts to link against Apple’s Network framework
Added pal_networkframework C API and entrypoints for TLS operations via Network Framework
Introduced Interop.Network and Interop.NetworkTls for managed interop and updated project files

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/tasks/LibraryBuilder/Templates/CMakeLists.txt.template	Link CLI library builder against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists.txt.template	Link Apple app builder target against Network framework
src/tasks/AppleAppBuilder/Templates/CMakeLists-librarymode.txt.template	Link Apple library‐mode builder against Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m	Implement TLS handshake and I/O callbacks using Network framework
src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h	Declare C API for Network Framework TLS functions
src/native/libs/System.Net.Security.Native.Apple/extra_libs.cmake	Find and append Network framework to native link list
src/native/libs/System.Net.Security.Native.Apple/entrypoints.c	Register native TLS entrypoints for DllImport
src/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt	Add and configure System.Net.Security.Native.Apple targets
src/native/libs/CMakeLists.txt	Include System.Net.Security.Native.Apple in native build when targeting Apple
src/mono/msbuild/apple/build/AppleBuild.targets	Add Network framework to Mono Apple app linker args
src/libraries/System.Net.Security/src/System.Net.Security.csproj	Include new Interop.OSX files in library project
src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs	Managed interop for Network Framework TLS operations
src/libraries/Common/src/Interop/OSX/Interop.Network.cs	Managed retain/release wrappers for Network Framework objects
src/libraries/Common/src/Interop/OSX/Interop.Libraries.cs	Define library constants for AppleNetworkNative and NetworkFramework
src/coreclr/nativeaot/BuildIntegration/Microsoft.NETCore.Native.Unix.targets	Add Network framework to NativeAOT Unix build targets

Comments suppressed due to low confidence (4)

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m:18

AppleNetNative_NwCreateContext currently hardcodes the endpoint to "127.0.0.1:42". Consider accepting host and port parameters or providing a separate function to configure the endpoint rather than using placeholder values.

PALEXPORT nw_connection_t AppleNetNative_NwCreateContext(int32_t isServer)

src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs:1

The new NetworkFramework TLS interop code is not accompanied by any unit tests. Consider adding tests for ALPN serialization, native call success paths, and error handling.

// Licensed to the .NET Foundation under one or more agreements.

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:57

Public functions in this header lack parameter and return-value documentation. Consider adding doc comments to clarify expected behavior, ownership, and possible error codes.

PALEXPORT int32_t AppleNetNative_NwInit(StatusUpdateCallback statusFunc, ReadCallback readFunc, WriteCallback writeFunc);

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.h:60

The declaration of AppleNetNative_NwProcessInputData includes the nw_framer_t framer parameter, but the header signature in this diff does not match the implementation. Ensure the header and implementation signatures align to avoid compilation errors.

PALEXPORT int32_t AppleNetNative_NwProcessInputData(nw_connection_t connection, nw_framer_t framer, const uint8_t * data, int dataLength);

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

src/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt

src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs

src/libraries/System.Net.Security/src/System.Net.Security.csproj

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m

src/libraries/Common/src/Interop/OSX/Interop.NetworkTls.cs

Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com>

liveans · 2025-06-28T13:33:48Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2025-06-28T13:33:57Z

Azure Pipelines successfully started running 1 pipeline(s).

dotnet-policy-service · 2025-06-28T14:20:30Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

src/installer/pkg/sfx/Microsoft.NETCore.App/Directory.Build.props

src/libraries/Common/src/Interop/OSX/Interop.Network.Tls.cs

wfurt · 2025-07-01T00:25:25Z

src/libraries/Common/src/Interop/OSX/Interop.Network.Tls.cs

+                        throw new ArgumentException(SR.net_ssl_app_protocols_invalid, nameof(applicationProtocols));
+                    }
+
+                    protocolSize += protocol.Protocol.Length + 2;


I'm wondering if we should put cap somewhere and throw some meaningful exception. I'm wondering if schannel or openssl also have some limits. (could be done as follow-up IMHO)

wfurt · 2025-07-01T00:26:27Z

src/libraries/Common/src/Interop/OSX/Interop.Network.Tls.cs

+            ConnectionCancelled = 103,
+        }
+
+        internal enum OSStatus


don't we already have the OSStatus somewhere...? I would thins most of them are pretty general.

We have only

runtime/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs

Lines 17 to 21 in 8104cb1

private const int OSStatus_writErr = -20;

private const int OSStatus_readErr = -19;

private const int OSStatus_noErr = 0;

private const int OSStatus_errSSLWouldBlock = -9803;

private const int InitialBufferSize = 2048;

Not sure what the best place for the shared definition would be, maybe Interop.AppleCrypto.OSStatus.

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m

wfurt · 2025-07-01T00:35:38Z

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m

+        framer_options = nw_framer_copy_options(framer);
+
+        NSNumber* num = nw_framer_options_copy_object_value(framer_options, "GCHANDLE");
+        assert(num != NULL);


yes, I think it its up to use to manage it. I think the assert is ok to let us know if our assumptions are wrong. at least in the early stages.

wfurt · 2025-07-01T00:37:22Z

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m

+        [num getValue:&ptr];
+        size_t size = message_length;
+
+        nw_framer_parse_output(framer, 1, message_length, NULL, ^size_t(uint8_t *buffer, size_t buffer_length, bool is_complete2) {


nitL I would rename is_complete2 to is_complete

wfurt · 2025-07-01T00:39:07Z

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m

+};
+
+static nw_framer_cleanup_handler_t framer_cleanup_handler = ^(nw_framer_t framer) {
+    (void)framer;


makes me wonder if we missed something. But if we did not, maybe we don't even need the empty handler. Any thoughts on this @filipnavara ?

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m

vcsjones · 2025-07-01T00:54:38Z

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m

+    // The endpoint values (127.0.0.1:42) are arbitrary - they just need to be
+    // syntactically and semantically valid since the connection is never established.
+    nw_parameters_t nw_parameters = nw_parameters_create_secure_udp(NW_PARAMETERS_DISABLE_PROTOCOL, NW_PARAMETERS_DEFAULT_CONFIGURATION);
+    nw_endpoint_t nw_endpoint = nw_endpoint_create_host("127.0.0.1", "42");


What happens if something is already bound on port 42? Like another .NET process?

nothing. There is no real socket. we just need to create some nw_endpoint.

actually, since this is create_host, maybe we can simply put in some text @liveans instead of using something that looks valid.

…phy.Native.Apple

…yptography.Native.Apple

rzikm · 2025-07-01T13:48:13Z

I am taking this over to land it in main ASAP while liveans is on vacation. I addressed most of the comments, I also have some Ideas how to move this forward, but will keep them for the followup PRs, PTAL

liveans added 6 commits June 16, 2025 19:54

Native Interop Layer

c062e18

Native Layer Compilation fix for Mono + NativeAOT + templates

ecba3f7

First shape of new native + interop

bf130f3

Newlines at the end of files

0dcc599

Default constructor ownsHandle to true

44b3597

Delete couple of unsafe keyword in Interop

3cbcea7

liveans requested review from stephentoub, wfurt, rzikm, a team and Copilot June 25, 2025 11:45

liveans requested review from steveisok, vitek-karas and MichalStrehovsky as code owners June 25, 2025 11:45

github-actions bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Jun 25, 2025

dotnet-policy-service bot assigned liveans Jun 25, 2025

Copilot AI reviewed Jun 25, 2025

View reviewed changes

src/native/libs/System.Net.Security.Native.Apple/pal_networkframework.m Outdated Show resolved Hide resolved

liveans and others added 2 commits June 25, 2025 13:48

Update src/native/libs/System.Net.Security.Native.Apple/pal_networkfr…

3defe85

…amework.m Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into network_framework_integration_native_interop

57a7069

vitek-karas requested a review from simonrozsival June 25, 2025 11:53

liveans requested review from filipnavara and simonrozsival and removed request for simonrozsival June 25, 2025 11:53

teo-tsirpanis reviewed Jun 25, 2025

View reviewed changes

src/native/libs/System.Net.Security.Native.Apple/CMakeLists.txt Outdated Show resolved Hide resolved

rzikm reviewed Jun 25, 2025

View reviewed changes

liveans added 2 commits June 25, 2025 15:54

Fix PlatformManifestFileEntry

c1a2b6b

Review feedback

0977679

This was referenced Jun 25, 2025

browser-wasm Windows build error #116746

Open

wasm build failure in CI #117017

Open

Build on Windows Fails sometimes with fatal error C1090: PDB API call failed #48070

Open

Update src/libraries/Common/src/Interop/OSX/Interop.Network.Tls.cs

0fff060

Co-authored-by: Radek Zikmund <32671551+rzikm@users.noreply.github.com>

This was referenced Jun 26, 2025

CI flakiness: mono interpreter build getting killed #114123

Open

Assertion failed 'm_dfsTree->Contains(dominator) && m_dfsTree->Contains(dominated)' #117039

Closed

liveans added 5 commits June 28, 2025 14:27

Review feedbacks

3441093

Merge branch 'main' into network_framework_integration_native_interop

3e547c5

Further review feedback

25b8950

Add new library name to nativeaot build target file

91238c5

Merge branch 'main' into network_framework_integration_native_interop

a250b67

teo-tsirpanis added area-System.Net.Security and removed needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Jun 28, 2025

wfurt reviewed Jul 1, 2025

View reviewed changes

vcsjones reviewed Jul 1, 2025

View reviewed changes

rzikm added 6 commits July 1, 2025 14:09

Merge System.Net.Security.Native.Apple with System.Security.Cryptogra…

beb5f93

…phy.Native.Apple

fixup! Merge System.Net.Security.Native.Apple with System.Security.Cr…

0ab06b2

…yptography.Native.Apple

Shared OSStatus

39bef6d

Correctly release some handles

8267454

Remove printf

4bf6eb9

Add comments

f771ea9

rzikm requested a review from wfurt July 1, 2025 13:48

rzikm self-assigned this Jul 2, 2025

Fix build

6ab3942

build-analysis bot mentioned this pull request Jul 2, 2025

Unable to pull image mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-22.04-helix-webassembly #117164

Open

	private const int OSStatus_writErr = -20;
	private const int OSStatus_readErr = -19;
	private const int OSStatus_noErr = 0;
	private const int OSStatus_errSSLWouldBlock = -9803;
	private const int InitialBufferSize = 2048;

[OSX][TLS 1.3] Network Framework Native Layer + Interop Classes Implementations #117016

Are you sure you want to change the base?

[OSX][TLS 1.3] Network Framework Native Layer + Interop Classes Implementations #117016

Uh oh!

Conversation

liveans commented Jun 25, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

liveans commented Jun 28, 2025

Uh oh!

azure-pipelines bot commented Jun 28, 2025

Uh oh!

dotnet-policy-service bot commented Jun 28, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rzikm commented Jul 1, 2025

Uh oh!

Uh oh!