Add SslStream legacy path compatibility switch

[rzikm]

Summary

Adds a compatibility switch that allows applications to temporarily restore the legacy SslStream handshake implementation instead of routing through the TlsSession wedge introduced by #130366.

The new switch is disabled by default, so existing behavior remains unchanged:

• AppContext: System.Net.Security.UseLegacySslStreamHandshake
• Environment variable: DOTNET_SYSTEM_NET_SECURITY_USELEGACYSSLSTREAMHANDSHAKE

When enabled, SslStream skips TryNextMessageViaTlsSession and uses its legacy GenerateToken path. This provides an operational rollback mechanism while the remaining work tracked by #131315 is completed.

Tests cover the default, explicit AppContext values, the environment variable, AppContext precedence in both directions, deterministic inherited-environment handling, both client and server path selection, and post-handshake data transfer.

Testing

• Built System.Net.Security successfully with zero warnings.
• SslStreamRemoteExecutorTests.UseLegacySslStreamHandshake_SelectsExpectedHandshakePath: 7 passed.

Related to #131315.

Note

This pull request description was created with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Adds an opt-in compatibility switch for SslStream to bypass the TlsSession wedge handshake path and fall back to the legacy GenerateToken handshake implementation, providing an operational rollback while the wedge integration work is completed.

Changes:

• Introduces System.Net.Security.UseLegacySslStream / DOTNET_SYSTEM_NET_SECURITY_USELEGACYSSLSTREAM via LocalAppContextSwitches.
• Gates SslStream’s NextMessage handshake flow to skip TryNextMessageViaTlsSession when the switch is enabled.
• Adds functional coverage (via RemoteExecutor) to validate handshake path selection and post-handshake data transfer.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamRemoteExecutorTests.cs	Adds a RemoteExecutor-based test that toggles AppContext/env var and asserts legacy vs wedge handshake selection.
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Adds the switch gate to control whether the wedge handshake path is used.
src/libraries/System.Net.Security/src/System/Net/Security/LocalAppContextSwitches.cs	Adds a cached compatibility switch with an AppContext key and environment variable override.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamRemoteExecutorTests.cs:43

• Using ProcessStartInfo.Environment.Add can throw if the variable is already present in the inherited environment, and when environmentValue is null the test does not clear the variable. That can make this test fail or become environment-dependent if DOTNET_SYSTEM_NET_SECURITY_USELEGACYSSLSTREAMHANDSHAKE is set externally.

            var psi = new ProcessStartInfo();
            if (environmentValue.HasValue)
            {
                psi.Environment.Add("DOTNET_SYSTEM_NET_SECURITY_USELEGACYSSLSTREAMHANDSHAKE", environmentValue.Value ? "1" : "0");
            }

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamRemoteExecutorTests.cs:36

• The precedence case where AppContext=true and environment=false isn't covered. Adding it helps ensure AppContext always wins over the environment variable in both directions.

        [InlineData(null, false, false)]
        [InlineData(null, true, true)]
        [InlineData(false, true, false)]

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.