openquantumsafe/curl is not working in Project IDX environment

[rishabhamar]

I am trying to setup a docket environment in project idx which supports X25519MLKEM768 curl but every time I do it, the connection fails.
What can i do in this situation if anyone knows how to use the docker container in project idx.
Project IDX is online developmental environment created by google and it uses nix os for its vm.
used the same docker file in my ubuntu virtual machine and it is working absolutley fine.
So what's the matter in Project IDX.

automated-tool-4605221:~/automated-tool$ source /home/user/automated-tool/.venv/bin/activate
(.venv) automated-tool-4605221:~/automated-tool$ docker run -it openquantumsafe/curl
Unable to find image 'openquantumsafe/curl:latest' locally
latest: Pulling from openquantumsafe/curl
1f3e46996e29: Pull complete 
c9b340e8c5cd: Pull complete 
4f4fb700ef54: Pull complete 
f6ee047c8584: Pull complete 
61365e2bffa3: Pull complete 
2c36706394cb: Pull complete 
b7e8964de4bc: Pull complete 
a24330819a52: Pull complete 
Digest: sha256:d9561abbc4327dc9f8875f029f40af1b4a33ef193b06bda748de9d9b88ee45b8
Status: Downloaded newer image for openquantumsafe/curl:latest
/opt/oqssa/bin $ Using default temp DH parameters
ACCEPT

/opt/oqssa/bin $ ls
CA.crt          CA.key          CA.srl          c_rehash        curl            curl-config     openssl         perftest.sh     serverstart.sh
/opt/oqssa/bin $ openssl version
OpenSSL 3.4.0 22 Oct 2024 (Library: OpenSSL 3.4.0 22 Oct 2024)
/opt/oqssa/bin $ curl version
curl: (6) Could not resolve host: version
/opt/oqssa/bin $ curl --version
curl 8.11.1 (x86_64-pc-linux-musl) libcurl/8.11.1 OpenSSL/3.4.0
Release-Date: 2024-12-11
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IPv6 Largefile NTLM SSL threadsafe TLS-SRP UnixSockets
/opt/oqssa/bin $ openssl s_client -connect fonts.google.com:443 -groups X25519MLKEM768 -provider oqsprovider
Connecting to 74.125.203.100
CONNECTED(00000003)
287B4EF74C7F0000:error:0A000410:SSL routines:ssl3_read_bytes:ssl/tls alert handshake failure:ssl/record/rec_layer_s3.c:908:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 1599 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
/opt/oqssa/bin $ curl --curves kyber768 https://www.google.com:443
curl: (35) TLS connect error: error:0A000410:SSL routines::ssl/tls alert handshake failure
/opt/oqssa/bin $ curl --curves X25519MLKEM768 https://www.google.com:443
curl: (35) TLS connect error: error:0A000410:SSL routines::ssl/tls alert handshake failure
/opt/oqssa/bin $ 

[baentsch]

I cannot reproduce this problem:

docker run -it openquantumsafe/curl sh -c "curl -k --curves X25519MLKEM768 https://www.google.com:443"

works perfectly for me (as it also seems to do for you, locally). So this is an issue that indeed should be raised in project IDX: I don't know that environment at all.

[rishabhamar]

Ok I will try to raise this query in Project IDX as well

[embetrix]

check if your curl is built using openssl backend (default is gnutls):

# curl --version
curl 8.7.1 (arm-ozyx-linux-gnueabi) libcurl/8.7.1 OpenSSL/3.2.3 zlib/1.3.1 libidn2/2.3.7
Release-Date: 2024-03-27
Protocols: file ftp ftps http https ipfs ipns
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IDN IPv6 Largefile libz NTLM SSL threadsafe TLS-SRP UnixSockets

I don't have any problems:

# curl -v -k --curves X25519MLKEM768 https://www.google.com:443 -o /dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Host www.google.com:443 was resolved.
* IPv6: (none)
* IPv4: 142.250.185.100
*   Trying 142.250.185.100:443...
* Connected to www.google.com (142.250.185.100) port 443
* ALPN: curl offers http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1604 bytes data]
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [1210 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [21 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [2511 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [79 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: CN=www.google.com
*  start date: Feb  3 08:38:01 2025 GMT
*  expire date: Apr 28 08:38:00 2025 GMT
*  issuer: C=US; O=Google Trust Services; CN=WE2
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
*   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
*   Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using sha256WithRSAEncryption
* using HTTP/1.x
} [5 bytes data]
> GET / HTTP/1.1
> Host: www.google.com
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [289 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [289 bytes data]
* old SSL session ID is stale, removing
{ [5 bytes data]
< HTTP/1.1 200 OK
< Date: Thu, 20 Feb 2025 13:27:10 GMT
< Expires: -1
< Cache-Control: private, max-age=0
< Content-Type: text/html; charset=ISO-8859-1
< Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-h476WXk4qZsd8VatzjQTfA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
< Accept-CH: Sec-CH-Prefers-Color-Scheme
< P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
< Server: gws
< X-XSS-Protection: 0
< X-Frame-Options: SAMEORIGIN
< Set-Cookie: AEC=AVcja2cglK8LDfxi3kkhDcPMUp5A3TB-HD63x3oEsbx-DciPzcMzhUW8jg; expires=Tue, 19-Aug-2025 13:27:10 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
< Set-Cookie: __Secure-ENID=25.SE=Ddgpbm9Kqn8Orumaw9hi0h5GnMX-jjqxfDqecexFvtlIVnP9gv-llOJuni4WSzCsFoo2QnX45dUXfTyffioU-JVIwH96sE-Ym68wN0NPWox2KOl-GDJpa28BPaJGTPh0Lzv3sbof6NYImrOV3aBohYdeKeDkq3qnoMQysdk03C1FUqfyEiABz8YkhAEQDSkqt08ZlQD4u-FGflQQFdZT; expires=Mon, 23-Mar-2026 05:45:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
< Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
< Accept-Ranges: none
< Vary: Accept-Encoding
< Transfer-Encoding: chunked
< 
{ [163 bytes data]
100 18562    0 18562    0     0  77532      0 --:--:-- --:--:-- --:--:-- 82132
* Connection #0 to host www.google.com left intact

[rishabhamar]

This is my Project IDX curl version

automated-tool-4605221:~/automated-tool$ source /home/user/automated-tool/.venv/bin/activate
(.venv) automated-tool-4605221:~/automated-tool$ curl --version
curl 8.7.1 (x86_64-pc-linux-gnu) libcurl/8.7.1 OpenSSL/3.0.14 zlib/1.3.1 brotli/1.1.0 zstd/1.5.6 libidn2/2.3.7 libpsl/0.21.5 libssh2/1.11.0 nghttp2/1.61.0
Release-Date: 2024-03-27
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd

And this is my docker curl version which I imported from the Docker OQS Curl Image

(.venv) automated-tool-4605221:~/automated-tool$ docker run -it --name=test2 --user root openquantumsafe/curl
/opt/oqssa/bin # Using default temp DH parameters
ACCEPT

/opt/oqssa/bin # curl -version
curl: (2) no URL specified
curl: try 'curl --help' or 'curl --manual' for more information
/opt/oqssa/bin # curl --version
curl 8.11.1 (x86_64-pc-linux-musl) libcurl/8.11.1 OpenSSL/3.4.0
Release-Date: 2024-12-11
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IPv6 Largefile NTLM SSL threadsafe TLS-SRP UnixSockets
/opt/oqssa/bin # curl -v -k --curves X25519MLKEM768 https://www.google.com:443 -o /dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Host www.google.com:443 was resolved.
* IPv6: 2404:6800:4008:c00::93, 2404:6800:4008:c00::69, 2404:6800:4008:c00::6a, 2404:6800:4008:c00::67
* IPv4: 108.177.125.147, 108.177.125.106, 108.177.125.105, 108.177.125.99, 108.177.125.104, 108.177.125.103
*   Trying [2404:6800:4008:c00::93]:443...
* Immediate connect fail for 2404:6800:4008:c00::93: Address not available
*   Trying [2404:6800:4008:c00::69]:443...
* Immediate connect fail for 2404:6800:4008:c00::69: Address not available
*   Trying [2404:6800:4008:c00::6a]:443...
* Immediate connect fail for 2404:6800:4008:c00::6a: Address not available
*   Trying [2404:6800:4008:c00::67]:443...
* Immediate connect fail for 2404:6800:4008:c00::67: Address not available
*   Trying 108.177.125.147:443...
* ALPN: curl offers http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1607 bytes data]
* TLSv1.3 (IN), TLS alert, handshake failure (552):
{ [2 bytes data]
* TLS connect error: error:0A000410:SSL routines::ssl/tls alert handshake failure
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* closing connection #0
curl: (35) TLS connect error: error:0A000410:SSL routines::ssl/tls alert handshake failure
/opt/oqssa/bin # 

Maybe the problem lies in the misconfigurations between the Project IDX (nix environment) and Docker Ubuntu Versions.

I will try to solve it and if it does then i will post the solution as well