CipherSuitesPolicy constructor throws PlatformNotSupportedException on Linux with OpenSSL 1.1.1 #61891
Comments
ghost
added
area-System.Net.Security
untriaged
|
Tagging subscribers to this area: @dotnet/ncl, @vcsjones Issue DetailsDescriptionAccording to the documentation, it should be possible to use the CipherSuitesPolicy class on Linux systems with OpenSSL 1.1.1 or higher or macOS. However, when using .NET 6 on Linux with OpenSSL 1.1.1, PlatformNotSupportedException is thrown. The same code completes successfully when using .NET 5 Reproduction StepsRun the following program: using System.Net.Security;
namespace csptest
{
public static class Program
{
public static void Main()
{
var cipherSuitesPolicy = new CipherSuitesPolicy(new TlsCipherSuite[] { });
}
}
}Expected behaviorProgram completes successfully Actual behaviorException is thrown: Regression?Works fine on .NET 5 Known WorkaroundsNo response Configuration.NET OpenSSL OS Same issue also occurs on Ubuntu 21.10 Other informationNo response
|
|
Hm, well, I can reproduce it on 21.10 using 6.0-RTM installed by binaries. |
|
There is something wrong with the loading. It works when I modify it as using System.Net.Security;
using System.Net.Http;
using System;
namespace csptest
{
public class Program
{
public static void Main()
{
try {
var client = new HttpClient();
_ = client.GetAsync("https://microsoft.com").GetAwaiter().GetResult();
} catch { };
var cipherSuitesPolicy = new CipherSuitesPolicy(new TlsCipherSuite[] { });
Console.WriteLine("Policy OK");
}
}
}
|
|
I wonder if the CipherSuitesPolicy ctor functionally depends on CryptoInitializer but doesn't actually cause it to run. |
|
It seems like the problem is ordering. I have two breakpoints and the following lldb/sos fragment is in order. So the method on Ssl class is called sooner than static constructor for given class. None of the logic seems to change in 6.0. |
|
That uses a static field initializer to populate the value. I that runs before the explicit cctor. So this has probably always had an ordering dependency on waking up something from the main crypto codepaths first; just for one reason or another it never came up. |
|
So the fix is probably just to delay call the routine private static int s_tls13Supported;
internal static bool Tls13Supported
{
get
{
if (s_tls13Supported == 0)
{
s_tls13Supported = Tls13SupportedImpl() ? 1 : -1;
}
return s_tls13Supported == 1;
}
} |
|
That does work. I'm not sure how much we care about loosing We could possibly fix up this particular in different ways (including the C PAL) But I'm wondering if we may have issues with other functions as well where somebody may (indirectly) call some functionality before fist SSL kicks in. |
ghost
added
the
in-pr
ghost
removed
the
in-pr
ghost
added
the
in-pr
ghost
removed
the
in-pr
ghost
added
the
in-pr
ghost
removed
the
in-pr
ghost
locked as resolved and limited conversation to collaborators
Uh oh!
There was an error while loading. Please reload this page.
Description
According to the documentation, it should be possible to use the CipherSuitesPolicy class on Linux systems with OpenSSL 1.1.1 or higher or macOS. However, when using .NET 6 on Linux with OpenSSL 1.1.1, PlatformNotSupportedException is thrown. The same code works fine when using .NET 5
Reproduction Steps
Run the following program:
Expected behavior
Program completes successfully
Actual behavior
Exception is thrown:
Regression?
Seems like it, as it works fine on .NET 5
Known Workarounds
No response
Configuration
.NET
.NET 6
OpenSSL
OpenSSL 1.1.1f
OS
Ubuntu 20.04.3 LTS x86_64 (completely clean install)
Same issue also occurs on Ubuntu 21.10
Other information
No response
The text was updated successfully, but these errors were encountered: