[
https://issues.apache.org/jira/browse/HADOOP-10693?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14050641#comment-14050641
]
Colin Patrick McCabe commented on HADOOP-10693:
-----------------------------------------------
bq. Right? (We can't make precondition on buildSupportsOpenssl directly, it
will fail if build without Openssl) Now I add it in the new patch.
Sounds good.
bq. Furthermore, in linux the shared library for OpenSSL 1.0.0x and 1.0.1x both
are “libcrypto.so.1.0.0”, but AES-CTR is only supported in 1.0.1x. So I add
following in the new patch to check the detailed version (we are not able to
get whether its 1.0.0x and 1.0.1x from the suffix):
I guess my question here is, if I compile against openssl 1.0.0 and run against
1.0.1, does AES-CTR work? My understanding is that it does. So we should not
fail the build just because the compiler has version 1.0.0.
As we talked about, we *should* fail the tests when {{buildSupportsOpenssl}} is
true but openssl is not working (that way, we will know we have a configuration
problem on Jenkins or any other build system.)
{code}
+JNIEXPORT void JNICALL Java_org_apache_hadoop_crypto_OpensslCipher_initIDs
+ (JNIEnv *env, jclass clazz)
{code}
Specifically, we should call {{const char \*SSLeay_version(int t);}} here and
throw an exception if the number is too low. We should not use the
{{#define}}, since that is the version we *compiled* with, which may not be the
same as the version we're *running* with. (In fact, it rarely will be the
same, due to the security and export control difficulties associated with
bundling openssl.)
> Implementation of AES-CTR CryptoCodec using JNI to OpenSSL
> ----------------------------------------------------------
>
> Key: HADOOP-10693
> URL: https://issues.apache.org/jira/browse/HADOOP-10693
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: security
> Affects Versions: fs-encryption (HADOOP-10150 and HDFS-6134)
> Reporter: Yi Liu
> Assignee: Yi Liu
> Fix For: fs-encryption (HADOOP-10150 and HDFS-6134)
>
> Attachments: HADOOP-10693.1.patch, HADOOP-10693.2.patch,
> HADOOP-10693.3.patch, HADOOP-10693.4.patch, HADOOP-10693.5.patch,
> HADOOP-10693.6.patch, HADOOP-10693.patch
>
>
> In HADOOP-10603, we have an implementation of AES-CTR CryptoCodec using Java
> JCE provider.
> To get high performance, the configured JCE provider should utilize native
> code and AES-NI, but in JDK6,7 the Java embedded provider doesn't support it.
>
> Considering not all hadoop user will use the provider like Diceros or able to
> get signed certificate from oracle to develop a custom provider, so this JIRA
> will have an implementation of AES-CTR CryptoCodec using JNI to OpenSSL
> directly.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
