[release/8.0] Detect ephemeral client cert key via SEC_E_UNKNOWN_CREDENTIALS in QUIC

src/libraries/System.Net.Quic/src/Resources/Strings.resx

@@ -189,6 +189,9 @@
   <data name="net_quic_tls_version_notsupported" xml:space="preserve">
     <value>Could not use a TLS version required by Quic. TLS 1.3 may have been disabled in the registry.</value>
   </data>
+  <data name="net_auth_ephemeral" xml:space="preserve">
+    <value>Authentication failed because the platform does not support ephemeral keys.</value>
+  </data>
   <data name="net_quic_empty_cipher_suite" xml:space="preserve">
     <value>CipherSuitePolicy must specify at least one cipher supported by QUIC.</value>
   </data>

src/libraries/System.Net.Quic/src/System.Net.Quic.csproj

@@ -46,6 +46,12 @@
   <ItemGroup Condition="'$(TargetPlatformIdentifier)' == 'windows'">
     <Compile Include="$(CommonPath)Interop\Windows\Interop.Libraries.cs" Link="Common\Interop\Windows\Interop.Libraries.cs" />
     <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CERT_CONTEXT.cs" Link="Common\Interop\Windows\Crypt32\Interop.CERT_CONTEXT.cs" />
+    <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CertContextPropId.cs" Link="Common\Interop\Windows\Crypt32\Interop.CertContextPropId.cs" />
+    <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CertDuplicateCertificateContext.cs" Link="Common\Interop\Windows\Crypt32\Interop.CertDuplicateCertificateContext.cs" />
+    <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CertGetCertificateContextProperty_NO_NULLABLE.cs" Link="Common\Interop\Windows\Crypt32\Interop.CertGetCertificateContextProperty_NO_NULLABLE.cs" />
+    <Compile Include="$(CommonPath)Microsoft\Win32\SafeHandles\SafeCrypt32Handle.cs" Link="Common\Microsoft\Win32\SafeHandles\SafeCrypt32Handle.cs" />
+    <Compile Include="$(CommonPath)Microsoft\Win32\SafeHandles\SafeHandleCache.cs" Link="Common\Microsoft\Win32\SafeHandles\SafeHandleCache.cs" />
+    <Compile Include="$(CommonPath)Microsoft\Win32\SafeHandles\SafeCertContextHandle.cs" Link="Common\Microsoft\Win32\SafeHandles\SafeCertContextHandle.cs" />
     <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CERT_INFO.cs" Link="Common\Interop\Windows\Crypt32\Interop.CERT_INFO.cs" />
     <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CERT_PUBLIC_KEY_INFO.cs" Link="Common\Interop\Windows\Crypt32\Interop.CERT_PUBLIC_KEY_INFO.cs" />
     <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CRYPT_ALGORITHM_IDENTIFIER.cs" Link="Common\Interop\Windows\Crypt32\Interop.Interop.CRYPT_ALGORITHM_IDENTIFIER.cs" />

src/libraries/System.Net.Quic/src/System/Net/Quic/Internal/MsQuicConfiguration.cs

@@ -4,9 +4,11 @@
 using System.Collections.Generic;
 using System.Collections.ObjectModel;
 using System.Net.Security;
+using System.Security.Authentication;
 using System.Security.Cryptography.X509Certificates;
 using System.Threading;
 using Microsoft.Quic;
+using Microsoft.Win32.SafeHandles;
 using static Microsoft.Quic.MsQuic;
 
 namespace System.Net.Quic;
@@ -206,6 +208,16 @@ private static unsafe MsQuicSafeHandle Create(QuicConnectionOptions options, QUI
             {
                 ThrowHelper.ThrowIfMsQuicError(status, SR.net_quic_tls_version_notsupported);
             }
+
+            if ((status == QUIC_STATUS_CERT_NO_CERT || (Interop.SECURITY_STATUS)status == Interop.SECURITY_STATUS.UnknownCredentials) &&
+                certificate is not null && certificate.HasPrivateKey())
+            {
+                using SafeCertContextHandle safeCertContextHandle = Interop.Crypt32.CertDuplicateCertificateContext(certificate.Handle);
+                if (safeCertContextHandle.HasEphemeralPrivateKey)
+                {
+                    throw new AuthenticationException(SR.net_auth_ephemeral);
+                }
+            }
 #endif
 
             ThrowHelper.ThrowIfMsQuicError(status, "ConfigurationLoadCredential failed");

src/libraries/System.Net.Quic/tests/FunctionalTests/MsQuicTests.cs

@@ -1364,5 +1364,44 @@ private async Task SniTestCore(string hostname, bool shouldSendSni)
         [InlineData("fe80::9c3a:b64d:6249:1de8%2")]
         [InlineData("fe80::9c3a:b64d:6249:1de8")]
         public Task DoesNotSendIPAsSni(string target) => SniTestCore(target, false);
+
+        [ConditionalFact]
+        [PlatformSpecific(TestPlatforms.Windows)]
+        public async Task Server_CertificateWithEphemeralKey_Throws()
+        {
+            using X509Certificate2 cert = System.Net.Test.Common.Configuration.Certificates.GetServerCertificate();
+            using ECDsa key = ECDsa.Create();
+            using X509Certificate2 ephemeralCert = cert.CopyWithPrivateKey(key);
+
+            QuicListenerOptions listenerOptions = CreateQuicListenerOptions();
+            listenerOptions.ConnectionOptionsCallback = (_, _, _) =>
+            {
+                QuicServerConnectionOptions serverOptions = CreateQuicServerOptions();
+                serverOptions.ServerAuthenticationOptions.ServerCertificate = ephemeralCert;
+                return ValueTask.FromResult(serverOptions);
+            };
+
+            await Assert.ThrowsAsync<AuthenticationException>(async () => await CreateQuicListener(listenerOptions));
+        }
+
+        [ConditionalFact]
+        [PlatformSpecific(TestPlatforms.Windows)]
+        public async Task Client_CertificateWithEphemeralKey_Throws()
+        {
+            if (PlatformDetection.IsWindows10Version20348OrLower)
+            {
+                throw new SkipTestException("Client certificates are not supported on Windows Server 2022.");
+            }
+
+            using X509Certificate2 cert = System.Net.Test.Common.Configuration.Certificates.GetClientCertificate();
+            using ECDsa key = ECDsa.Create();
+            using X509Certificate2 ephemeralCert = cert.CopyWithPrivateKey(key);
+
+            await using QuicListener listener = await CreateQuicListener();
+            QuicClientConnectionOptions clientOptions = CreateQuicClientOptions(listener.LocalEndPoint);
+            clientOptions.ClientAuthenticationOptions.ClientCertificates = new X509CertificateCollection() { ephemeralCert };
+
+            await Assert.ThrowsAsync<AuthenticationException>(async () => await CreateQuicConnection(clientOptions));
+        }
     }
 }