[
https://issues.apache.org/jira/browse/HADOOP-10693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Yi Liu updated HADOOP-10693:
----------------------------
Attachment: HADOOP-10693.7.patch
[~cmccabe], thank you for the review. I update the patch based on your new
comments and the discussion which we talked offline.
{quote}
I guess my question here is, if I compile against openssl 1.0.0 and run against
1.0.1, does AES-CTR work? My understanding is that it does. So we should not
fail the build just because the compiler has version 1.0.0.
{quote}
In the new patch, I remove openssl version (1.0.0 or 1.0.1) check in
CMakeLists.txt, now it can be compiled against openssl 1.0.0 and run against
1.0.1.
{quote}
As we talked about, we should fail the tests when buildSupportsOpenssl is true
but openssl is not working (that way, we will know we have a configuration
problem on Jenkins or any other build system.)
{quote}
Yes, this has been included.
{quote}
Specifically, we should call const char *SSLeay_version(int t); here and throw
an exception if the number is too low. We should not use the #define, since
that is the version we compiled with, which may not be the same as the version
we're running with. (In fact, it rarely will be the same, due to the security
and export control difficulties associated with bundling openssl.)
{quote}
Basically dlsym for aes-ctr related symbols will fail if the Openssl version is
not new enough, so we don’t need to check the version specifically. And I
refine the error message to:
{{Cannot find AES-CTR support, is your version of Openssl new enough?}}
> Implementation of AES-CTR CryptoCodec using JNI to OpenSSL
> ----------------------------------------------------------
>
> Key: HADOOP-10693
> URL: https://issues.apache.org/jira/browse/HADOOP-10693
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: security
> Affects Versions: fs-encryption (HADOOP-10150 and HDFS-6134)
> Reporter: Yi Liu
> Assignee: Yi Liu
> Fix For: fs-encryption (HADOOP-10150 and HDFS-6134)
>
> Attachments: HADOOP-10693.1.patch, HADOOP-10693.2.patch,
> HADOOP-10693.3.patch, HADOOP-10693.4.patch, HADOOP-10693.5.patch,
> HADOOP-10693.6.patch, HADOOP-10693.7.patch, HADOOP-10693.patch
>
>
> In HADOOP-10603, we have an implementation of AES-CTR CryptoCodec using Java
> JCE provider.
> To get high performance, the configured JCE provider should utilize native
> code and AES-NI, but in JDK6,7 the Java embedded provider doesn't support it.
>
> Considering not all hadoop user will use the provider like Diceros or able to
> get signed certificate from oracle to develop a custom provider, so this JIRA
> will have an implementation of AES-CTR CryptoCodec using JNI to OpenSSL
> directly.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
