Enable OSX_10_10 flag by default

security-framework-sys/Cargo.toml

@@ -20,6 +20,7 @@ libc = "0.2.150"
 default = ["OSX_10_12"]
 # Always enabled. No-op.
 OSX_10_9 = []
+# Always enabled. No-op.
 OSX_10_10 = ["OSX_10_9"]
 OSX_10_11 = ["OSX_10_10"]
 OSX_10_12 = ["OSX_10_11"]

security-framework-sys/src/secure_transport.rs

@@ -27,16 +27,23 @@ pub const kTLSProtocol1Only: SSLProtocol = 5;
 pub const kSSLProtocolAll: SSLProtocol = 6;
 
 pub type SSLSessionOption = c_int;
+#[deprecated(note = "deprecated by Apple")]
 pub const kSSLSessionOptionBreakOnServerAuth: SSLSessionOption = 0;
+#[deprecated(note = "deprecated by Apple")]
 pub const kSSLSessionOptionBreakOnCertRequested: SSLSessionOption = 1;
+#[deprecated(note = "deprecated by Apple")]
 pub const kSSLSessionOptionBreakOnClientAuth: SSLSessionOption = 2;
+#[deprecated(note = "deprecated by Apple")]
 pub const kSSLSessionOptionFalseStart: SSLSessionOption = 3;
 pub const kSSLSessionOptionSendOneByteRecord: SSLSessionOption = 4;
-#[cfg(all(feature = "OSX_10_11", not(any(target_os = "ios", target_os = "tvos", target_os = "watchos", target_os = "visionos"))))]
+#[cfg(all(feature = "OSX_10_11", target_os = "macos"))]
+#[deprecated(note = "deprecated by Apple")]
 pub const kSSLSessionOptionAllowServerIdentityChange: SSLSessionOption = 5;
-#[cfg(all(feature = "OSX_10_10", not(any(target_os = "ios", target_os = "tvos", target_os = "watchos", target_os = "visionos"))))]
+#[cfg(target_os = "macos")]
+#[deprecated(note = "deprecated by Apple")]
 pub const kSSLSessionOptionFallback: SSLSessionOption = 6;
-#[cfg(all(feature = "OSX_10_11", not(any(target_os = "ios", target_os = "tvos", target_os = "watchos", target_os = "visionos"))))]
+#[cfg(all(feature = "OSX_10_11", target_os = "macos"))]
+#[deprecated(note = "deprecated by Apple")]
 pub const kSSLSessionOptionBreakOnClientHello: SSLSessionOption = 7;
 
 pub type SSLSessionState = c_int;

security-framework/src/os/macos/secure_transport.rs

@@ -53,24 +53,20 @@ pub trait SslContextExt {
     ///
     /// Requires the `OSX_10_11` (or greater) feature.
     #[cfg(feature = "OSX_10_11")]
+    #[deprecated(note = "kSSLSessionOptionAllowServerIdentityChange is deprecated by Apple")]
     fn set_allow_server_identity_change(&mut self, value: bool) -> Result<()>;
 
     /// If enabled, fallback countermeasures will be used during negotiation.
     ///
     /// It should be enabled when renegotiating with a peer with a lower
     /// maximum protocol version due to an earlier failure to connect.
-    ///
-    /// Requires the `OSX_10_10` (or greater) feature.
-    #[cfg(feature = "OSX_10_10")]
     fn fallback(&self) -> Result<bool>;
 
     /// If enabled, fallback countermeasures will be used during negotiation.
     ///
     /// It should be enabled when renegotiating with a peer with a lower
     /// maximum protocol version due to an earlier failure to connect.
-    ///
-    /// Requires the `OSX_10_10` (or greater) feature.
-    #[cfg(feature = "OSX_10_10")]
+    #[deprecated(note = "kSSLSessionOptionFallback is deprecated by Apple")]
     fn set_fallback(&mut self, value: bool) -> Result<()>;
 
     /// If enabled, the handshake process will pause and return when the client
@@ -85,12 +81,14 @@ pub trait SslContextExt {
     ///
     /// Requires the `OSX_10_11` (or greater) feature.
     #[cfg(feature = "OSX_10_11")]
+    #[deprecated(note = "kSSLSessionOptionBreakOnClientHello is deprecated by Apple")]
     fn set_break_on_client_hello(&mut self, value: bool) -> Result<()>;
 }
 
 macro_rules! impl_options {
     ($($(#[$a:meta])* const $opt:ident: $get:ident & $set:ident,)*) => {
         $(
+            #[allow(deprecated)]
             $(#[$a])*
             #[inline]
             fn $set(&mut self, value: bool) -> Result<()> {
@@ -101,6 +99,7 @@ macro_rules! impl_options {
                 }
             }
 
+            #[allow(deprecated)]
             $(#[$a])*
             #[inline]
             fn $get(&self) -> Result<bool> {
@@ -184,7 +183,6 @@ impl SslContextExt for SslContext {
     impl_options! {
         #[cfg(feature = "OSX_10_11")]
         const kSSLSessionOptionAllowServerIdentityChange: allow_server_identity_change & set_allow_server_identity_change,
-        #[cfg(feature = "OSX_10_10")]
         const kSSLSessionOptionFallback: fallback & set_fallback,
         #[cfg(feature = "OSX_10_11")]
         const kSSLSessionOptionBreakOnClientHello: break_on_client_hello & set_break_on_client_hello,

security-framework/src/passwords.rs

@@ -211,6 +211,7 @@ mod test {
     }
 
     #[test]
+    #[cfg(feature = "OSX_10_12")]
     fn update_generic() {
         let name = "update_generic";
         set_generic_password(name, name, name.as_bytes()).expect("set_generic_password");

security-framework/src/secure_transport.rs

@@ -460,12 +460,14 @@ impl AsInner for SslContext {
 macro_rules! impl_options {
     ($($(#[$a:meta])* const $opt:ident: $get:ident & $set:ident,)*) => {
         $(
+            #[allow(deprecated)]
             $(#[$a])*
             #[inline(always)]
             pub fn $set(&mut self, value: bool) -> Result<()> {
                 unsafe { cvt(SSLSetSessionOption(self.0, $opt, value as Boolean)) }
             }
 
+            #[allow(deprecated)]
             $(#[$a])*
             #[inline]
             pub fn $get(&self) -> Result<bool> {

systest/Cargo.toml

@@ -14,7 +14,7 @@ libc = "0.2.139"
 ctest2 = "0.4.7"
 
 [features]
-default = ["security-framework-sys/OSX_10_9"]
+default = ["OSX_10_10", "security-framework-sys/OSX_10_9"]
 OSX_10_10 = ["security-framework-sys/OSX_10_10"]
 OSX_10_11 = ["OSX_10_10", "security-framework-sys/OSX_10_11"]
 OSX_10_12 = ["OSX_10_11", "security-framework-sys/OSX_10_12"]