Is ALPN support in OpenSSL a required feature?

[omajid]

This code doesn't make it clear:

runtime/src/libraries/Native/Unix/System.Security.Cryptography.Native/opensslshim.h

Lines 462 to 471 in 0ea3b7d

	REQUIRED_FUNCTION(SSL_set_alpn_protos) \
	REQUIRED_FUNCTION(SSL_set_quiet_shutdown) \
	REQUIRED_FUNCTION(SSL_CTX_check_private_key) \
	FALLBACK_FUNCTION(SSL_CTX_config) \
	REQUIRED_FUNCTION(SSL_CTX_ctrl) \
	REQUIRED_FUNCTION(SSL_CTX_free) \
	FALLBACK_FUNCTION(SSL_is_init_finished) \
	REQUIRED_FUNCTION(SSL_CTX_new) \
	LIGHTUP_FUNCTION(SSL_CTX_set_alpn_protos) \
	LIGHTUP_FUNCTION(SSL_CTX_set_alpn_select_cb) \

SSL_set_alpn_protos is required, but SSL_CTX_set_alpn_protos is a lightup? Is that right/intentional? Seems to me like both should be lightup (or both required).

Older versions of OpenSSL 1.0 don't have either of these symbols, and now the runtime fails when running against those.

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

This code doesn't make it clear:

runtime/src/libraries/Native/Unix/System.Security.Cryptography.Native/opensslshim.h

Lines 462 to 471 in 0ea3b7d

	REQUIRED_FUNCTION(SSL_set_alpn_protos) \
	REQUIRED_FUNCTION(SSL_set_quiet_shutdown) \
	REQUIRED_FUNCTION(SSL_CTX_check_private_key) \
	FALLBACK_FUNCTION(SSL_CTX_config) \
	REQUIRED_FUNCTION(SSL_CTX_ctrl) \
	REQUIRED_FUNCTION(SSL_CTX_free) \
	FALLBACK_FUNCTION(SSL_is_init_finished) \
	REQUIRED_FUNCTION(SSL_CTX_new) \
	LIGHTUP_FUNCTION(SSL_CTX_set_alpn_protos) \
	LIGHTUP_FUNCTION(SSL_CTX_set_alpn_select_cb) \

SSL_set_alpn_protos is required, but SSL_CTX_set_alpn_protos is a lightup? Is that right/intentional? Seems to me like both should be lightup (or both required). Older versions of OpenSSL 1.0 don't have either of these symbols.

Author:	omajid
Assignees:	-
Labels:	area-System.Security, untriaged
Milestone:	-

[omajid]

cc @bartonjs @crummel

[omajid]

cc @wfurt

[wfurt]

I think the expectation is to support 1.0.2 or older. (unless we can kill it as will since that is unsupported by OpenSSL)
And ALPN is essential for HTTP2.
I can look into why the expectation is different.

[bartonjs]

and now the runtime fails when running against those.

What version(s) does that affect? I thought we had coverage across 1.0.2+

[omajid]

See dotnet/installer#11750 which seems to be OpenSSL 1.0.1e-60.1. That's such an old version of RHEL that I am okay with requiring something more recent.

[wfurt]

That would be great. There was similar issue with Ubuntu 14.04 ... but even the 16.04 way too old now and out os support. (should still work as we have it as part of CI matrix)

[wfurt]

BTW I just check and for Centos 7 I have OpenSSL 1.0.2k-fips.(and that should be sufficient) Is that not available for rhel-7?

[omajid]

Is that not available for rhel-7

It is, or at least something close enough. CentOS rebuilds packages from RHEL, so I am going to be really really surprised if the latest RHEL package is older.

The issue that came up in the installer CI is only because an old container image is being used. It seems like this was the baseline RHEL 7 container created when .NET Core 1.0 was released, and it hasn't been updated since.

[wfurt]

nice. It is amazing that it lasted that long :)