Support Multiple Credentials in Kernel Mode Schannel

[nibanks]

Description

Adds a new API to support passing multiple credetials to Schannel in kernel mode. Fixes #3141.

Testing

TODO

Documentation

TODO

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 84.23%. Comparing base (9cab5bf) to head (d1b016a).
Report is 6 commits behind head on main.

❗ Current head d1b016a differs from pull request most recent head 2f8afbd

Please upload reports for the commit 2f8afbd to get more accurate results.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4096      +/-   ##
==========================================
- Coverage   86.04%   84.23%   -1.82%     
==========================================
  Files          56       56              
  Lines       15382    15384       +2     
==========================================
- Hits        13236    12958     -278     
- Misses       2146     2426     +280     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[anrossi]

Looks fine to me.
Regarding testing, the setup script could create two certificates for the server, instead of just one (which chain up to the same root certificate), and those two certificates could have different parameters (key algorithm, and hash algorithm).
Then the client could ban one algorithm in its configuration that matches one server cert, but not the other, and ensure the client connects successfully. and then ban the other algorithm and verify again. Also, ban both, and verify the client fails.