[QUIC] Support for OpenSSL build of MsQuic on Windows

[rzikm]

Currently, we assume that on Windows, MsQuic always uses Schannel for TLS operations and on Linux it uses OpenSSL. This influences how we pass certificates to MsQuic

runtime/src/libraries/System.Net.Quic/src/System/Net/Quic/Implementations/MsQuic/Interop/SafeMsQuicConfigurationHandle.cs

Lines 183 to 221 in a4223dc

	if (OperatingSystem.IsWindows())
	{
	config.Type = QUIC_CREDENTIAL_TYPE.CERTIFICATE_CONTEXT;
	config.CertificateContext = (void*)certificate.Handle;
	status = MsQuicApi.Api.ApiTable->ConfigurationLoadCredential(configurationHandle.QuicHandle, &config);
	}
	else
	{
	byte[] asn1;
	if (intermediates?.Length > 0)
	{
	X509Certificate2Collection collection = new X509Certificate2Collection();
	collection.Add(certificate);
	for (int i = 0; i < intermediates?.Length; i++)
	{
	collection.Add(intermediates[i]);
	}
	asn1 = collection.Export(X509ContentType.Pkcs12)!;
	}
	else
	{
	asn1 = certificate.Export(X509ContentType.Pkcs12);
	}
	fixed (byte* ptr = asn1)
	{
	QUIC_CERTIFICATE_PKCS12 pkcs12Config = new QUIC_CERTIFICATE_PKCS12
	{
	Asn1Blob = ptr,
	Asn1BlobLength = (uint)asn1.Length,
	PrivateKeyPassword = (sbyte*)IntPtr.Zero
	};
	config.Type = QUIC_CREDENTIAL_TYPE.CERTIFICATE_PKCS12;
	config.CertificatePkcs12 = &pkcs12Config;
	status = MsQuicApi.Api.ApiTable->ConfigurationLoadCredential(configurationHandle.QuicHandle, &config);
	}

And also some certificate related flags:

runtime/src/libraries/System.Net.Quic/src/System/Net/Quic/Implementations/MsQuic/Interop/SafeMsQuicConfigurationHandle.cs

Lines 55 to 58 in a4223dc

	if (OperatingSystem.IsWindows())
	{
	flags |= QUIC_CREDENTIAL_FLAGS.USE_SUPPLIED_CREDENTIALS;
	}

However, it is possible to build MsQuic with OpenSSL for Windows (e.g. to use on older Windows without TLS 1.3 support via Schannel). So we should instead make these decision based on the actual TLS backend being used. This information can be retrieved via recently added API: microsoft/msquic#2762.

[ghost]

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Currently, we assume that on Windows, MsQuic uses Schannel for TLS operations and on LInux it uses OpenSSL. This influences how we pass certificates to MsQuic

runtime/src/libraries/System.Net.Quic/src/System/Net/Quic/Implementations/MsQuic/Interop/SafeMsQuicConfigurationHandle.cs

Lines 183 to 221 in a4223dc

	if (OperatingSystem.IsWindows())
	{
	config.Type = QUIC_CREDENTIAL_TYPE.CERTIFICATE_CONTEXT;
	config.CertificateContext = (void*)certificate.Handle;
	status = MsQuicApi.Api.ApiTable->ConfigurationLoadCredential(configurationHandle.QuicHandle, &config);
	}
	else
	{
	byte[] asn1;
	if (intermediates?.Length > 0)
	{
	X509Certificate2Collection collection = new X509Certificate2Collection();
	collection.Add(certificate);
	for (int i = 0; i < intermediates?.Length; i++)
	{
	collection.Add(intermediates[i]);
	}
	asn1 = collection.Export(X509ContentType.Pkcs12)!;
	}
	else
	{
	asn1 = certificate.Export(X509ContentType.Pkcs12);
	}
	fixed (byte* ptr = asn1)
	{
	QUIC_CERTIFICATE_PKCS12 pkcs12Config = new QUIC_CERTIFICATE_PKCS12
	{
	Asn1Blob = ptr,
	Asn1BlobLength = (uint)asn1.Length,
	PrivateKeyPassword = (sbyte*)IntPtr.Zero
	};
	config.Type = QUIC_CREDENTIAL_TYPE.CERTIFICATE_PKCS12;
	config.CertificatePkcs12 = &pkcs12Config;
	status = MsQuicApi.Api.ApiTable->ConfigurationLoadCredential(configurationHandle.QuicHandle, &config);
	}

And also some certificate related flags:

runtime/src/libraries/System.Net.Quic/src/System/Net/Quic/Implementations/MsQuic/Interop/SafeMsQuicConfigurationHandle.cs

Lines 55 to 58 in a4223dc

	if (OperatingSystem.IsWindows())
	{
	flags |= QUIC_CREDENTIAL_FLAGS.USE_SUPPLIED_CREDENTIALS;
	}

However, it is possible to build MsQuic with OpenSSL for Windows (e.g. to use on older Windows without TLS 1.3 support via Schannel). So we should instead make these decision based on the actual TLS backend being used. This information can be retrieved via recently added API: microsoft/msquic#2762.

Author:	rzikm
Assignees:	-
Labels:	area-System.Net.Quic
Milestone:	-

[CarnaViire]

#72262 would be reverted in #72456, because it supposedly triggered strange native crashes on schannel-unsupported platforms, see #72429. We need to investigate before reintroducing the change.