Large numbers of Quic tests failed when run locally

[danmoseley]

I ran all inner+outerloop tests on my Windows 11 laptop (21H2 22000.675).

770 System.Net.Quic tests failed with "SEC_E_ALGORITHM_MISMATCH | The client and server cannot communicate, because they do not possess a common algorithm."

    <test name="System.Net.Quic.Tests.QuicConnectionTests_MsQuicProvider.Dispose_WithPendingAcceptAndConnect_PendingAndSubsequentThrowOperationAbortedException" type="System.Net.Quic.Tests.QuicConnectionTests_MsQuicProvider" method="Dispose_WithPendingAcceptAndConnect_PendingAndSubsequentThrowOperationAbortedException" time="0.0306188" result="Fail">
        <failure exception-type="Microsoft.Quic.MsQuicException">
          <message><![CDATA[Microsoft.Quic.MsQuicException : ConfigurationLoadCredential failed: Unknown status '-2146893007']]></message>
          <stack-trace><![CDATA[   at Microsoft.Quic.MsQuic.ThrowIfFailure(Int32 status, String message) in C:\git\runtime\src\libraries\System.Net.Quic\src\System\Net\Quic\Implementations\MsQuic\Interop\msquic.cs:line 47
   at System.Net.Quic.Implementations.MsQuic.Internal.SafeMsQuicConfigurationHandle.Create(QuicOptions options, QUIC_CREDENTIAL_FLAGS flags, X509Certificate certificate, SslStreamCertificateContext certificateContext, List`1 alpnProtocols, CipherSuitesPolicy cipherSuitesPolicy) in C:\git\runtime\src\libraries\System.Net.Quic\src\System\Net\Quic\Implementations\MsQuic\Interop\SafeMsQuicConfigurationHandle.cs:line 237
   at System.Net.Quic.Implementations.MsQuic.Internal.SafeMsQuicConfigurationHandle.Create(QuicClientConnectionOptions options) in 

As far as I know there's nothing special about my machine. How should I diagnose this?

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

---

I ran all inner+outerloop tests on my Windows 11 laptop (21H2 22000.675).

770 System.Net.Quic tests failed with "SEC_E_ALGORITHM_MISMATCH | The client and server cannot communicate, because they do not possess a common algorithm."

    <test name="System.Net.Quic.Tests.QuicConnectionTests_MsQuicProvider.Dispose_WithPendingAcceptAndConnect_PendingAndSubsequentThrowOperationAbortedException" type="System.Net.Quic.Tests.QuicConnectionTests_MsQuicProvider" method="Dispose_WithPendingAcceptAndConnect_PendingAndSubsequentThrowOperationAbortedException" time="0.0306188" result="Fail">
        <failure exception-type="Microsoft.Quic.MsQuicException">
          <message><![CDATA[Microsoft.Quic.MsQuicException : ConfigurationLoadCredential failed: Unknown status '-2146893007']]></message>
          <stack-trace><![CDATA[   at Microsoft.Quic.MsQuic.ThrowIfFailure(Int32 status, String message) in C:\git\runtime\src\libraries\System.Net.Quic\src\System\Net\Quic\Implementations\MsQuic\Interop\msquic.cs:line 47
   at System.Net.Quic.Implementations.MsQuic.Internal.SafeMsQuicConfigurationHandle.Create(QuicOptions options, QUIC_CREDENTIAL_FLAGS flags, X509Certificate certificate, SslStreamCertificateContext certificateContext, List`1 alpnProtocols, CipherSuitesPolicy cipherSuitesPolicy) in C:\git\runtime\src\libraries\System.Net.Quic\src\System\Net\Quic\Implementations\MsQuic\Interop\SafeMsQuicConfigurationHandle.cs:line 237
   at System.Net.Quic.Implementations.MsQuic.Internal.SafeMsQuicConfigurationHandle.Create(QuicClientConnectionOptions options) in 

As far as I know there's nothing special about my machine. How should I diagnose this?

Author:	danmoseley
Assignees:	-
Labels:	area-System.Net.Quic
Milestone:	-

[wfurt]

Do you have anything in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols ?
(or ciphers/CipherSuites)

It feels like the system is somehow constrained to run QUIC.

[ManickaP]

About the ability to diagnose this. @rzikm @wfurt what kind of details does SslStream provide when similar issue happen? I'm wondering if we should include details about provided vs expected algorithms, but only if it doesn't have any security impact and if we already do or consider doing this for SslStream?

[danmoseley]

I have

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"DisabledByDefault"=dword:00000000
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client]
"DisabledByDefault"=dword:00000001

[danmoseley]

Regardless of the cause, if a customer might see this perhaps the exception should have a custom message like " The client and server cannot communicate, because they do not possess a common algorithm." instead of "ConfigurationLoadCredential failed: Unknown status '-2146893007'"?

[danmoseley]

(Although, as a non expert, I wouldn't know how to proceed faced even with that message, it might at least give more of a clue.)

[wfurt]

while the root cause is not clear, this is similar to #55237 in essence IMHO.
Unfortunately, at this point the way how to solve some of this is to enable MsQuic tracing because we are dependent on native binaries and some some of the knowledge is not easy to surface in managed code.

Out of curiosity, would the outcome change if you flip DisabledByDefault to 0 for Tls 1.3?

[danmoseley]

Out of curiosity, would the outcome change if you flip DisabledByDefault to 0 for Tls 1.3?

When I do this the tests pass. (I don't remember ever setting this key myself...?)

[danmoseley]

so indeed this seems similar to #55237, but the message when TLS1.3 is disabled is still not clear.

[wfurt]

MsIT ??? ;(
AFAIK this is not the default. Perhaps #66019 could be improved.

[danmoseley]

What could have helped here is a MsQuicException message like (assuming Windows) "TLS1.3 is disabled. Check your Windows version is XX.YYYY or later, and that HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client@DisabledByDefault has the value 0"

Perhaps that would avoid a support call? Of course if basically nobody ever sets this key and it's just my machine got messed up, maybe it's not worth it.

[ManickaP]

Yeah, we check for Enabled = 1 but we haven't considered DisabledByDefault, we can expand the check, that should do.

@rzikm do you want to take this? I don't have Win11 machine on hand to test this.