SSLStream fails

[rgroenewoudt]

Android application type

Android for .NET (net6.0-android, etc.)

Affected platform version

VS2022 17.4.1

Description

On Android 9+ it works fine.

Using SSLStream on an Android 8 device fails with:

System.err] java.lang.IllegalStateException: Handshake has already been started
[System.err] 	at com.android.org.conscrypt.OpenSSLEngineImpl.beginHandshakeInternal(OpenSSLEngineImpl.java:335)
[System.err] 	at com.android.org.conscrypt.OpenSSLEngineImpl.beginHandshake(OpenSSLEngineImpl.java:325)

On Android 6 this fails with:

System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception.
[mono-rt]  ---> System.PlatformNotSupportedException: Setting an SNI hostname is not supported on this API level.
[mono-rt]    at Interop.AndroidCrypto.SSLStreamSetTargetHost(SafeSslHandle sslHandle, String targetHost)

Documentation doesn't indicate this as an known issue.

Steps to Reproduce

using var client = new TcpClient("login.sequrix.com", 443);
            using var stream = new SslStream(client.GetStream(), false);
            stream.AuthenticateAsClient(new SslClientAuthenticationOptions()
            {
                TargetHost = "login.sequrix.com"
            });
            stream.Read(new byte[100], 0, 100);

AndroidApp4.zip

Did you find any workaround?

No response

Relevant log output

Time	Device Name	Type	PID	Tag	Message
11-22 16:06:53.606	pixel_5_-_api_26	Warning	8609	System.err	java.lang.IllegalStateException: Handshake has already been started
	at com.android.org.conscrypt.OpenSSLEngineImpl.beginHandshakeInternal(OpenSSLEngineImpl.java:335)
	at com.android.org.conscrypt.OpenSSLEngineImpl.beginHandshake(OpenSSLEngineImpl.java:325)
11-22 16:06:53.607	pixel_5_-_api_26	Verbose	8609	SequriX	Push error: System.Security.Authentication.AuthenticationException: net_auth_SSPI
 ---> Interop+AndroidCrypto+SslException: Exception_WasThrown, Interop+AndroidCrypto+SslException
   Exception_EndOfInnerExceptionStack
   at System.Net.Security.SslStream.<ForceAuthenticationAsync>d__175`1[[System.Net.Security.AsyncReadWriteAdapter, System.Net.Security, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]].MoveNext()
   at SuperSocket.ClientEngine.SslStreamTcpSession.AuthenticateAsClientAsync(SslStream sslStream, SecurityOption securityOption)

[rgroenewoudt]

System.Net.WebSockets.ClientWebsocket also uses SSLStream so this breaks using TLS websocket entirely on devices using Android <9.

[michaldobrodenka]

My workaround is to use Xamarin.Android for now

[steveisok]

Closing in favor of dotnet/runtime#78716 and dotnet/runtime#78715