Skip to content

Commit 147999b

Browse files
GitHubber17GitHubber17
authored
Merge pull request #4977 from dotpaul/tlsrules
TLS Roslyn Analyzers rules
2 parents 69b2411 + 1346794 commit 147999b

File tree

5 files changed

+476
-0
lines changed

5 files changed

+476
-0
lines changed

‎docs/code-quality/ca5361.md

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
---
2+
title: "CA5361: Do not disable SChannel use of strong crypto"
3+
description: Provides information about code analysis rule CA5361, including causes, how to fix violations, and when to suppress it.
4+
ms.date: 07/12/2019
5+
ms.topic: reference
6+
author: dotpaul
7+
ms.author: paulming
8+
manager: jillfra
9+
dev_langs:
10+
- CSharp
11+
- VB
12+
ms.workload:
13+
- "multiple"
14+
f1_keywords:
15+
- "CA5361"
16+
- "DoNotSetSwitch"
17+
---
18+
# CA5361: Do not disable SChannel use of strong crypto
19+
20+
|||
21+
|-|-|
22+
|TypeName|DoNotSetSwitch|
23+
|CheckId|CA5361|
24+
|Category|Microsoft.Security|
25+
|Breaking Change|Non Breaking|
26+
27+
## Cause
28+
29+
A <xref:System.AppContext.SetSwitch%2A?displayProperty=nameWithType> method call sets `Switch.System.Net.DontEnableSchUseStrongCrypto` to `true`.
30+
31+
## Rule description
32+
33+
Setting `Switch.System.Net.DontEnableSchUseStrongCrypto` to `true` weakens the cryptography used in outgoing Transport Layer Security (TLS) connections. Weaker cryptography can compromise the confidentiality of communication between your application and the server, making it easier for attackers to eavesdrop sensitive data. For more information, see [Transport Layer Security (TLS) best practices with the .NET Framework](/dotnet/framework/network-programming/tls#switchsystemnetdontenableschusestrongcrypto).
34+
35+
## How to fix violations
36+
37+
- If your application targets .NET Framework v4.6 or later, you can either remove the <xref:System.AppContext.SetSwitch%2A?displayProperty=nameWithType> method call, or set the switch's value to `false`.
38+
- If your application targets .NET Framework earlier than v4.6 and runs on .NET Framework v4.6 or later, set the switch's value to `false`.
39+
- Otherwise, refer to [Transport Layer Security (TLS) best practices with the .NET Framework](/dotnet/framework/network-programming/tls) for mitigations.
40+
41+
## When to suppress warnings
42+
43+
You can suppress this warning if you need to connect to a legacy service that can't be upgraded to use secure TLS configurations.
44+
45+
## Pseudo-code examples
46+
47+
### Violation
48+
49+
```csharp
50+
using System;
51+
52+
public class ExampleClass
53+
{
54+
public void ExampleMethod()
55+
{
56+
// CA5361 violation
57+
AppContext.SetSwitch("Switch.System.Net.DontEnableSchUseStrongCrypto", true);
58+
}
59+
}
60+
```
61+
62+
```vb
63+
Imports System
64+
65+
Public Class ExampleClass
66+
Public Sub ExampleMethod()
67+
' CA5361 violation
68+
AppContext.SetSwitch("Switch.System.Net.DontEnableSchUseStrongCrypto", true)
69+
End Sub
70+
End Class
71+
```
72+
73+
### Solution
74+
75+
```csharp
76+
using System;
77+
78+
public class ExampleClass
79+
{
80+
public void ExampleMethod()
81+
{
82+
AppContext.SetSwitch("Switch.System.Net.DontEnableSchUseStrongCrypto", false);
83+
}
84+
}
85+
```
86+
87+
```vb
88+
Imports System
89+
90+
Public Class ExampleClass
91+
Public Sub ExampleMethod()
92+
AppContext.SetSwitch("Switch.System.Net.DontEnableSchUseStrongCrypto", false)
93+
End Sub
94+
End Class
95+
```

‎docs/code-quality/ca5364.md

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
---
2+
title: "CA5364: Do not use deprecated security protocols"
3+
description: Provides information about code analysis rule CA5364, including causes, how to fix violations, and when to suppress it.
4+
ms.date: 07/12/2019
5+
ms.topic: reference
6+
author: dotpaul
7+
ms.author: paulming
8+
manager: jillfra
9+
dev_langs:
10+
- CSharp
11+
- VB
12+
ms.workload:
13+
- "multiple"
14+
f1_keywords:
15+
- "CA5364"
16+
- "DoNotUseDeprecatedSecurityProtocols"
17+
---
18+
# CA5364: Do not use deprecated security protocols
19+
20+
|||
21+
|-|-|
22+
|TypeName|DoNotUseDeprecatedSecurityProtocols|
23+
|CheckId|CA5364|
24+
|Category|Microsoft.Security|
25+
|Breaking Change|Non Breaking|
26+
27+
## Cause
28+
29+
This rule fires when either of the following conditions are met:
30+
- A deprecated <xref:System.Net.SecurityProtocolType?displayProperty=nameWithType> value was referenced.
31+
- An integer value representing a deprecated value was assigned to a <xref:System.Net.SecurityProtocolType> variable.
32+
33+
Deprecated values are:
34+
- Ssl3
35+
- Tls
36+
- Tls10
37+
- Tls11
38+
39+
## Rule description
40+
41+
Transport Layer Security (TLS) secures communication between computers, most commonly with Hypertext Transfer Protocol Secure (HTTPS). Older protocol versions of TLS are less secure than TLS 1.2 and TLS 1.3, and are more likely to have new vulnerabilities. Avoid older protocol versions to minimize risk. For guidance on identifying and removing deprecated protocol versions, see [Solving the TLS 1.0 Problem, 2nd Edition](/security/solving-tls1-problem).
42+
43+
## How to fix violations
44+
45+
Don't use deprecated TLS protocol versions.
46+
47+
## When to suppress warnings
48+
49+
You can suppress this warning if:
50+
- The reference to the deprecated protocol version isn't being used to enable a deprecated version.
51+
- You need to connect to a legacy service that can't be upgraded to use secure TLS configurations.
52+
53+
## Pseudo-code examples
54+
55+
### Violation
56+
57+
```csharp
58+
using System;
59+
using System.Net;
60+
61+
public class ExampleClass
62+
{
63+
public void ExampleMethod()
64+
{
65+
// CA5364 violation
66+
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;
67+
}
68+
}
69+
```
70+
71+
```vb
72+
Imports System
73+
Imports System.Net
74+
75+
Public Class TestClass
76+
Public Sub ExampleMethod()
77+
' CA5364 violation
78+
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11 Or SecurityProtocolType.Tls12
79+
End Sub
80+
End Class
81+
```
82+
83+
### Violation
84+
85+
```csharp
86+
using System;
87+
using System.Net;
88+
89+
public class ExampleClass
90+
{
91+
public void ExampleMethod()
92+
{
93+
// CA5364 violation
94+
ServicePointManager.SecurityProtocol = (SecurityProtocolType) 768; // TLS 1.1
95+
}
96+
}
97+
```
98+
99+
```vb
100+
Imports System
101+
Imports System.Net
102+
103+
Public Class TestClass
104+
Public Sub ExampleMethod()
105+
' CA5364 violation
106+
ServicePointManager.SecurityProtocol = CType(768, SecurityProtocolType) ' TLS 1.1
107+
End Sub
108+
End Class
109+
```
110+
111+
### Solution
112+
113+
```csharp
114+
using System;
115+
using System.Net;
116+
117+
public class TestClass
118+
{
119+
public void TestMethod()
120+
{
121+
// Let the operating system decide what TLS protocol version to use.
122+
// See https://docs.microsoft.com/dotnet/framework/network-programming/tls
123+
}
124+
}
125+
```
126+
127+
```vb
128+
Imports System
129+
Imports System.Net
130+
131+
Public Class TestClass
132+
Public Sub ExampleMethod()
133+
' Let the operating system decide what TLS protocol version to use.
134+
' See https://docs.microsoft.com/dotnet/framework/network-programming/tls
135+
End Sub
136+
End Class
137+
```
138+
139+
## Related rules
140+
141+
[CA5386: Avoid hardcoding SecurityProtocolType value](ca5386.md)

‎docs/code-quality/ca5378.md

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
---
2+
title: "CA5378: Do not disable ServicePointManagerSecurityProtocols"
3+
description: Provides information about code analysis rule CA5378, including causes, how to fix violations, and when to suppress it.
4+
ms.date: 07/12/2019
5+
ms.topic: reference
6+
author: dotpaul
7+
ms.author: paulming
8+
manager: jillfra
9+
dev_langs:
10+
- CSharp
11+
- VB
12+
ms.workload:
13+
- "multiple"
14+
f1_keywords:
15+
- "CA5378"
16+
- "DoNotSetSwitch"
17+
---
18+
# CA5378: Do not disable ServicePointManagerSecurityProtocols
19+
20+
|||
21+
|-|-|
22+
|TypeName|DoNotSetSwitch|
23+
|CheckId|CA5378|
24+
|Category|Microsoft.Security|
25+
|Breaking Change|Non Breaking|
26+
27+
## Cause
28+
29+
A <xref:System.AppContext.SetSwitch%2A?displayProperty=nameWithType> method call sets `Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols` to `true`.
30+
31+
## Rule description
32+
33+
Setting `Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols` to `true` limits Windows Communication Framework's (WCF) Transport Layer Security (TLS) connections to using TLS 1.0. That version of TLS will be deprecated. For more information, see [Transport Layer Security (TLS) best practices with the .NET Framework](/dotnet/framework/network-programming/tls#switchsystemservicemodeldisableusingservicepointmanagersecurityprotocols).
34+
35+
## How to fix violations
36+
37+
- If your application targets .NET Framework v4.7 or later, you can either remove the <xref:System.AppContext.SetSwitch%2A?displayProperty=nameWithType> method call, or set the switch's value to `false`.
38+
- If your application targets .NET Framework v4.6.2 or earlier and runs on .NET Framework v4.7 or later, set the switch's value to `false`.
39+
- Otherwise, refer to [Transport Layer Security (TLS) best practices with the .NET Framework](/dotnet/framework/network-programming/tls) for mitigations.
40+
41+
## When to suppress warnings
42+
43+
You can suppress this warning if you need to connect to a legacy service that can't be upgraded to use secure TLS configurations.
44+
45+
## Pseudo-code examples
46+
47+
### Violation
48+
49+
```csharp
50+
using System;
51+
52+
public class ExampleClass
53+
{
54+
public void ExampleMethod()
55+
{
56+
// CA5378 violation
57+
AppContext.SetSwitch("Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols", true);
58+
}
59+
}
60+
```
61+
62+
```vb
63+
Imports System
64+
65+
Public Class ExampleClass
66+
Public Sub ExampleMethod()
67+
' CA5378 violation
68+
AppContext.SetSwitch("Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols", true)
69+
End Sub
70+
End Class
71+
```
72+
73+
### Solution
74+
75+
```csharp
76+
using System;
77+
78+
public class ExampleClass
79+
{
80+
public void ExampleMethod()
81+
{
82+
AppContext.SetSwitch("Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols", false);
83+
}
84+
}
85+
```
86+
87+
```vb
88+
Imports System
89+
90+
Public Class ExampleClass
91+
Public Sub ExampleMethod()
92+
AppContext.SetSwitch("Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols", false)
93+
End Sub
94+
End Class
95+
```

0 commit comments

Comments
 (0)