[HADOOP-16647] Support OpenSSL 1.1.1 LTS

• Type: Task
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 3.3.0, 3.2.2, 2.10.1
• Component/s: security
• Target Version/s: 3.3.0, 2.10.1
• Hadoop Flags: Reviewed
• Assignee: Rakesh Radhakrishnan
• Reporter: Wei-Chiu Chuang
• Created: 09/Oct/19 20:05
• Updated: 08/May/20 06:16
• Resolved: 03/Apr/20 23:34

Description

See Hadoop user mailing list http://mail-archives.apache.org/mod_mbox/hadoop-user/201910.mbox/%3CCADiq6%3DweDFxHTL_7eGwDNnxVCza39y2QYQTSggfLn7mXhMLOdg%40mail.gmail.com%3E

Hadoop 2 supports OpenSSL 1.0.2.
Hadoop 3 supports OpenSSL 1.1.0 (HADOOP-14597) and I believe 1.0.2 too.

Per OpenSSL blog https://www.openssl.org/policies/releasestrat.html

• 1.1.0 is EOL 2019/09/11
• 1.0.2 EOL 2019/12/31
• 1.1.1 is EOL 2023/09/11 (LTS)

Many Hadoop installation relies on the OpenSSL package provided by Linux distros, but it's not clear to me if Linux distros are going support 1.1.0/1.0.2 beyond this date.

We should make sure Hadoop works with OpenSSL 1.1.1, as well as document the openssl version supported. File this jira to test/document/fix bugs.

Issue Links

• is depended upon by: HDFS-15098 Add SM4 encryption method for HDFS
• relates to: HADOOP-16405 Upgrade Wildfly Openssl version to 1.0.7.Final
• relates to: HADOOP-14597 Native compilation broken with OpenSSL-1.1.0 because EVP_CIPHER_CTX has been made opaque