Add openssl version 3.0+ support for Linux platforms #499
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
WilburZjh
force-pushed
the
opensslv3-support
branch
from
7a50e99 to
f1899ea
Compare
|
Pls fix the copyright and line endings failures. |
WilburZjh
force-pushed
the
opensslv3-support
branch
from
9fc7daf to
cd36a42
Compare
keithc-ca
requested changes
Apr 11, 2022
closed/src/java.base/share/classes/jdk/crypto/jniprovider/NativeCrypto.java
Outdated
Show resolved
Hide resolved
closed/src/java.base/share/classes/jdk/crypto/jniprovider/NativeCrypto.java
Outdated
Show resolved
Hide resolved
closed/src/java.base/share/classes/jdk/crypto/jniprovider/NativeCrypto.java
Outdated
Show resolved
Hide resolved
WilburZjh
force-pushed
the
opensslv3-support
branch
from
cd36a42 to
472c0d2
Compare
|
The declaration in (This assumes the proposed change to |
alon-sh
reviewed
Apr 11, 2022
WilburZjh
force-pushed
the
opensslv3-support
branch
2 times, most recently
from
a5eefa9 to
1ec09b8
Compare
|
Manual testing on a machine (rhel8le-rt1-1) with openssl3 looks good. I'm also running the openjdk crypto/security tests I could find from sanity/extended on the same machine, /job/Grinder/22688. |
|
Setting as draft since there is one failure (that occurred 4 times). jdk_security2_0 |
This was referenced Apr 12, 2022
|
I missed a piece of output, added in previous comment |
|
No other failures found in the previous openjdk test run. Also ran some additional internal tests, which passed. |
keithc-ca
changed the title
keithc-ca
requested changes
Apr 12, 2022
| @@ -40,11 +40,16 @@ public class NativeCrypto { | |||
| private static final int ossl_ver = AccessController.doPrivileged( | |||
There was a problem hiding this comment.
The comment on lines 36-39 needs to be updated.
closed/src/java.base/share/classes/jdk/crypto/jniprovider/NativeCrypto.java
Outdated
Show resolved
Hide resolved
closed/src/java.base/share/classes/jdk/crypto/jniprovider/NativeCrypto.java
Outdated
Show resolved
Hide resolved
closed/src/java.base/share/native/libjncrypto/NativeCrypto_md.h
Outdated
Show resolved
Hide resolved
| /* Per new OpenSSL naming convention starting from OpenSSL3, all major versions are ABI and API compatible. */ | ||
| #define OPENSSL_VERSION_3_0 "OpenSSL 3." | ||
|
|
||
| /* needed for OpenSSL 1.0.2 Thread handling routines. */ |
There was a problem hiding this comment.
This isn't a sentence; a period is not appropriate.
There was a problem hiding this comment.
@WilburZjh can you please fix this, I think everything else was addressed.
There was a problem hiding this comment.
The other review comment seems a different situation, it's code that was incorrect. In this case, Keith has suggested the code comment is not formed as a sentence and so the period at the end should be removed. Either remove the period, or re-write the code comment as a sentence.
There was a problem hiding this comment.
You say edited, and I see a force push, but I don't see the expected change.
|
Re: Changes will also be required:
I think we can separate allowing use of openssl3 at runtime vs building with it. FYI #500 and friends for 8, 17 so far. There are currently problems building on Windows as you know. |
|
|
See #499 (comment) and #500. |
|
I investigated that one failure in GCMParameterSpecTest.java. The issue is that OpenSSL3 only supports IV lengths up to 16Bytes, see here When the IV length is set to be larger than 16Bytes, an error is thrown. In OpenSSL1.1.1 and older, there is no error thrown but OpenSSL documentation states behavior is unpredictable for large IV sizes. Given this is a failure by design due to OpenSSL implementation, I suggest we merge OpenSSL3 support as it currently is but document that IV sizes above 16Bytes are not supported by OpenSSL and if a user needs such functionality - they should disable OpenSSL support via command line. |
pshipton
requested changes
Apr 14, 2022
WilburZjh
force-pushed
the
opensslv3-support
branch
2 times, most recently
from
2f9004f to
2c5244d
Compare
pshipton
changed the title
|
Note commit titles should preferably not end in a period. |
|
Before this can come out of draft and be merged, the following test needs to be updated so it doesn't fail with openssl3. Or excluded, but better if it's fixed to avoid IV lengths greater than 16 and we continue to have the test coverage. com/sun/crypto/provider/Cipher/AEAD/GCMParameterSpecTest.java |
|
Testing the test change at https://openj9-jenkins.osuosl.org/view/Test/job/Grinder/779/ |
WilburZjh
force-pushed
the
opensslv3-support
branch
from
c72604d to
f69a0f3
Compare
|
Testing passed, removing from draft state. @keithc-ca anything else? |
pshipton
approved these changes
Apr 14, 2022
WilburZjh
force-pushed
the
opensslv3-support
branch
from
f62c33b to
c04d8cc
Compare
|
Testing on alinux, zlinux didn't uncover any other issues. OpenSSL 3 doesn't build on the xlinux build machines atm due to a missing perl module (IPC/Cmd.pm - infrastructure/issues/6790). |
keithc-ca
reviewed
Apr 14, 2022
| /* Per new OpenSSL naming convention starting from OpenSSL3, all major versions are ABI and API compatible. */ | ||
| #define OPENSSL_VERSION_3_0 "OpenSSL 3." | ||
|
|
||
| /* needed for OpenSSL 1.0.2 Thread handling routines. */ |
WilburZjh
force-pushed
the
opensslv3-support
branch
4 times, most recently
from
e0b459b to
04ca799
Compare
|
jenkins compile alinux64 jdk11 |
|
Retest looks good |
keithc-ca
reviewed
Apr 19, 2022
test/jdk/com/sun/crypto/provider/Cipher/AEAD/GCMParameterSpecTest.java
Outdated
Show resolved
Hide resolved
WilburZjh
force-pushed
the
opensslv3-support
branch
from
cea7211 to
bfb218e
Compare
keithc-ca
reviewed
Apr 19, 2022
test/jdk/com/sun/crypto/provider/Cipher/AEAD/GCMParameterSpecTest.java
Outdated
Show resolved
Hide resolved
WilburZjh
force-pushed
the
opensslv3-support
branch
from
c93900a to
5255aa8
Compare
keithc-ca
reviewed
Apr 19, 2022
test/jdk/com/sun/crypto/provider/Cipher/AEAD/GCMParameterSpecTest.java
Outdated
Show resolved
Hide resolved
Signed-off-by: Jinhang Zhang <[email protected]>
WilburZjh
force-pushed
the
opensslv3-support
branch
from
3baf8db to
3cd7e91
Compare
keithc-ca
approved these changes
Apr 19, 2022
Comment on lines
+57
to
+60
| struct link_map *map = NULL; | ||
| dlinfo(result, RTLD_DI_LINKMAP, &map); | ||
| fprintf(stderr, "Attempt to load OpenSSL %s\n", map->l_name); | ||
| fflush(stderr); |
There was a problem hiding this comment.
This ought to check that dlinfo() succeeds and, perhaps, that NULL != map, but because we only take that path for tracing, it can wait for a future pull request.
|
jenkins test sanity aix,osx,xlinux,win jdk11 |
|
@WilburZjh pls create/update PRs for the other versions to contain the same changes. |
|
Yes, for sure. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue eclipse-openj9/openj9#13686