You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This commit doesn't have the interface QUICHE needs for handshake.
After discussing with @PiotrSikora, boringssl certifies once a year, so it's impossible to roll forward the FIPS dependency. And on quic side, it's not easy work to platform-ize all the boringssl interfaces it relies on.
So the current approach suggested by @alyssawilk is disabling all the QUIC related tests in boringssl FIPS build, basically compile-option. I added nofips tag in most of the build targets under source/extensions/quic_listeners/quiche/ and test/extensions/quic_listeners/quiche/, and excluded any targets with tap = ["nofips"] in #7328.
This will disable all the quic related envoy tests in compile-option ci till the next FIPS update. And there probably will be another quic interface change in boringssl in near future. This may cause same problem for one more year if the change couldn't get in before next cut for boringssl FIPS.
And in future integration, quic listener need to be factorized to avoid being depended by envoy core code directly.
The text was updated successfully, but these errors were encountered:
This is for documentation purpose regarding the interface compatibility issue we encountered while bring in QUICHE code into envoy.
As of 2018 Nov, quic interface was added to boringssl: https://boringssl.googlesource.com/boringssl/+/c8e0f90f83b9ec38ea833deb86b5a41360b62b6a. And later QUICHE has changed its interface accordingly. But envoy compil-options ci build envoy with boringssl FIPS, which is certified at a commit behind c8e0f90f83b9ec38ea833deb86b5a41360b62b6a:
This commit doesn't have the interface QUICHE needs for handshake.
After discussing with @PiotrSikora, boringssl certifies once a year, so it's impossible to roll forward the FIPS dependency. And on quic side, it's not easy work to platform-ize all the boringssl interfaces it relies on.
So the current approach suggested by @alyssawilk is disabling all the QUIC related tests in boringssl FIPS build, basically compile-option. I added
nofips
tag in most of the build targets under source/extensions/quic_listeners/quiche/ and test/extensions/quic_listeners/quiche/, and excluded any targets withtap = ["nofips"]
in #7328.This will disable all the quic related envoy tests in compile-option ci till the next FIPS update. And there probably will be another quic interface change in boringssl in near future. This may cause same problem for one more year if the change couldn't get in before next cut for boringssl FIPS.
And in future integration, quic listener need to be factorized to avoid being depended by envoy core code directly.
The text was updated successfully, but these errors were encountered: