Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

re-enable QUICHE tests when boringssl FIPS support of QUIC interface #7433

Open
danzh2010 opened this issue Jul 1, 2019 · 0 comments
Open
Labels

Comments

@danzh2010
Copy link
Contributor

danzh2010 commented Jul 1, 2019

This is for documentation purpose regarding the interface compatibility issue we encountered while bring in QUICHE code into envoy.

As of 2018 Nov, quic interface was added to boringssl: https://boringssl.googlesource.com/boringssl/+/c8e0f90f83b9ec38ea833deb86b5a41360b62b6a. And later QUICHE has changed its interface accordingly. But envoy compil-options ci build envoy with boringssl FIPS, which is certified at a commit behind c8e0f90f83b9ec38ea833deb86b5a41360b62b6a:

boringssl_fips = dict(
sha256 = "b12ad676ee533824f698741bd127f6fbc82c46344398a6d78d25e62c6c418c73",
# fips-20180730
urls = ["https://commondatastorage.googleapis.com/chromium-boringssl-docs/fips/boringssl-66005f41fbc3529ffe8d007708756720529da20d.tar.xz"],
)

This commit doesn't have the interface QUICHE needs for handshake.

After discussing with @PiotrSikora, boringssl certifies once a year, so it's impossible to roll forward the FIPS dependency. And on quic side, it's not easy work to platform-ize all the boringssl interfaces it relies on.

So the current approach suggested by @alyssawilk is disabling all the QUIC related tests in boringssl FIPS build, basically compile-option. I added nofips tag in most of the build targets under source/extensions/quic_listeners/quiche/ and test/extensions/quic_listeners/quiche/, and excluded any targets with tap = ["nofips"] in #7328.

This will disable all the quic related envoy tests in compile-option ci till the next FIPS update. And there probably will be another quic interface change in boringssl in near future. This may cause same problem for one more year if the change couldn't get in before next cut for boringssl FIPS.

And in future integration, quic listener need to be factorized to avoid being depended by envoy core code directly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants