Skip to content

msquic does not load with OpenSSL in FIPS mode #3422

@wfurt

Description

@wfurt

Describe the bug

This impacts Centos 7 and Mariner 2.0 (OpenSSL 1.1.1k FIPS) and perhaps other Linux versions.
the load fails as

: symbol lookup error: /lib/libmsquic.so.2: undefined symbol: EVP_chacha20_poly1305, version OPENSSL_1_1_0

CHACHA is not approved algorithm and it is missing in system crypto binaries.
This seems to defeat only purpose of UseSystemOpenSSLCrypto option.

Affected OS

  • Windows
  • Linux
  • macOS
  • Other (specify below)

Additional OS information

Centos 7 and Mariner 2.0

MsQuic version

release/2.1

Steps taken to reproduce bug

Try to load published msquic library on impacted OS.

Expected behavior

libmsquic loads and ignores unsupported algorithms. If only CHACHA was requested via policy, API calls should return proper error.

Actual outcome

libmsuic fails to load because of missing dependencies.

Additional details

we should make QUIC_ALLOWED_CIPHER_SUITE_CHACHA20_POLY1305_SHA256 fully optional. (and related code)

cc: @ManickaP @CarnaViire

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions