improve accuracy of SslClientHelloInfo

[wfurt]

We construct SslClientHelloInfo when using ServerOptionsSelectionCallback delegate. That was primarily meant to SNI but is also have bit mask of client supported versions. The change makes sure we process all of them from the client hello.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR improves SslStream server-side ClientHello handling so ServerOptionsSelectionCallback receives TLS versions advertised via the supported_versions extension, especially for TLS 1.3.

Changes:

• Enables ClientHello supported-version parsing when a server options callback is configured.
• Adds a TLS 1.3 regression test verifying the callback sees Tls13.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs	Adds supported-version parsing for the server options callback path.
src/libraries/System.Net.Security/tests/FunctionalTests/ServerAsyncAuthenticateTest.cs	Adds regression coverage for TLS 1.3 version visibility in the SNI/options callback.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs:531

• Now that Versions is enabled for the SNI callback path, this parser should reject malformed supported_versions vectors before exposing them to user code. TryGetSupportedVersionsFromExtension currently returns true for a zero-length vector and for odd byte counts (it just drops the trailing byte), even though the TLS vector must contain one or more 2-byte ProtocolVersion values. That can make SslClientHelloInfo.SslProtocols look valid but incomplete for malformed ClientHello messages.

                else if (extensionType == ExtensionType.SupportedVersions && (options & ProcessingOptions.Versions) != 0)
                {
                    if (!TryGetSupportedVersionsFromExtension(extensionData, out SslProtocols versions))
                    {
                        return false;

[rzikm]

LGTM

[rzikm]

cc @MihaZupan

[rzikm]

/ba-g test failure is unrelated