Support OpenSSL-based MsQuic on Windows #72262
Conversation
|
Tagging subscribers to this area: @dotnet/ncl Issue DetailsCloses 69978. While not officially supported, it is not hard for us to support QUIC on older Windows version via OpenSSL-based build of MsQuic. The only limitation now is that the
|
|
I tested the build with locally built MsQuic on Windows 11, it would be nice if somebody tested this e.g. on Windows 10 machine to confirm this. |
src/libraries/System.Net.Quic/src/System/Net/Quic/Internal/MsQuicApi.cs
Outdated
Show resolved
Hide resolved
…uicApi.cs Co-authored-by: Marie Píchová <11718369+ManickaP@users.noreply.github.com>
…for-OpenSSL-build-of-MsQuic-on-Windows
|
Does OpenSSL work well on windows? |
AFAIK, MsQuic has tests for that scenario e.g. it is supported combination for them. Since this depend only on crypto, I see no reason why this would work any different than Linux. |
| // Assume SChanel is being used on windows and query for the actual provider from the library | ||
| QUIC_TLS_PROVIDER provider = OperatingSystem.IsWindows() ? QUIC_TLS_PROVIDER.SCHANNEL : QUIC_TLS_PROVIDER.OPENSSL; | ||
| size = sizeof(QUIC_TLS_PROVIDER); | ||
| apiTable->GetParam(null, QUIC_PARAM_GLOBAL_TLS_PROVIDER, &size, &provider); |
There was a problem hiding this comment.
Do we expect that the provider will not change if there is MsQuic version that does not support the query?
There was a problem hiding this comment.
I don't expect MsQuic would remove the param in future versions. And with older versions we have no way of knowing which provider is used so we might as well assume SChannel on Windows and OpenSSL everywhere else as we do now.
There was a problem hiding this comment.
The question was really about running on older msquic versions. I don't know if this was added in/prior to 2.0 or if that is more recent addition.
There was a problem hiding this comment.
I think it's fine to assume this and state that MsQuic+OpenSSL is only supported on Windows for MsQuic v2+.
Yes, very well. It is is more feature complete than Schannel. The perf of OpenSSL crypto is not quite as good as in-box bcrypt though. |
|
I tried in a Windows 10 VM and most of the tests pass. I debugged those that fail these seem to have failed due to some "Access Denied" error in |
This reverts commit 3e5f0c1.
Closes #69978.
While not officially supported, it is not hard for us to support QUIC on older Windows version via OpenSSL-based build of MsQuic.
The only limitation now is that the
X509Certificate2instances must have exportable private keys (i.e. passingX509KeyStorageFlags.Exportableto ctor).