OpenSSL in librados
Hi, please forgive me if this has been asked before - I could not find any information on this topic. I am using ceph with librados via the phprados extension. Since upgrading to the current ceph versions where OpenSSL is used in in librados, I observe that using PHP's libcurl integration and other features which rely on OpenSSL randomly fail when opening a TLS connection. I suspect that librados somehow initializes or uninitializes OpenSSL in a way that interferes with the OpenSSL usage of libcurl / PHP's fsockopen. Did anybody make a similar experience? Thanks, Patrick
Hi,
Am 24.02.2023 um 16:55 schrieb Patrick Schlangen <patrick@schlangen.me>: I observe that using PHP's libcurl integration and other features which rely on OpenSSL randomly fail when opening a TLS connection. I suspect that librados somehow initializes or uninitializes OpenSSL in a way that interferes with the OpenSSL usage of libcurl / PHP's fsockopen.
some more details: This happens when trying to use OpenSSL after rados_shutdown(). It looks like rados_shutdown() causes TOPNSPC::crypto::shutdown() to be called which tears down OpenSSL and, by doing so, breaks SSL usage in libcurl / PHP afterwards. This only happens with OpenSSL 1.0 since with 1.1 the init/uninit concept has changed and ceph doesn't do an explicit uninit anymore. I think it would be good if librados would give an option to avoid OpenSSL teardown at rados_shutdown() to not break other OpenSSL users in the same process. Best, Patrick
On Sat, Feb 25, 2023 at 12:43 PM Patrick Schlangen <patrick@schlangen.me> wrote:
Hi,
Am 24.02.2023 um 16:55 schrieb Patrick Schlangen <patrick@schlangen.me>: I observe that using PHP's libcurl integration and other features which rely on OpenSSL randomly fail when opening a TLS connection. I suspect that librados somehow initializes or uninitializes OpenSSL in a way that interferes with the OpenSSL usage of libcurl / PHP's fsockopen.
some more details: This happens when trying to use OpenSSL after rados_shutdown(). It looks like rados_shutdown() causes TOPNSPC::crypto::shutdown() to be called which tears down OpenSSL and, by doing so, breaks SSL usage in libcurl / PHP afterwards.
This only happens with OpenSSL 1.0 since with 1.1 the init/uninit concept has changed and ceph doesn't do an explicit uninit anymore.
I think it would be good if librados would give an option to avoid OpenSSL teardown at rados_shutdown() to not break other OpenSSL users in the same process.
Hi Patrick, Isn't OpenSSL 1.0 long out of support? I'm not sure if extending librados API to support a workaround for something that went EOL over three years ago is worth it. Thanks, Ilya
Hi Ilya,
Am 26.02.2023 um 14:05 schrieb Ilya Dryomov <idryomov@gmail.com>:
Isn't OpenSSL 1.0 long out of support? I'm not sure if extending librados API to support a workaround for something that went EOL over three years ago is worth it.
fair point. However, as long as ceph still supports compiling against OpenSSL 1.0 and has special code paths to initialize OpenSSL for versions <= 1.0, I think this should be fixed. The other option would be to remove OpenSSL 1.0 support completely. What do you think? Thanks, Patrick
On Sun, Feb 26, 2023 at 2:15 PM Patrick Schlangen <patrick@schlangen.me> wrote:
Hi Ilya,
Am 26.02.2023 um 14:05 schrieb Ilya Dryomov <idryomov@gmail.com>:
Isn't OpenSSL 1.0 long out of support? I'm not sure if extending librados API to support a workaround for something that went EOL over three years ago is worth it.
fair point. However, as long as ceph still supports compiling against OpenSSL 1.0 and has special code paths to initialize OpenSSL for versions <= 1.0, I think this should be fixed. The other option would be to remove OpenSSL 1.0 support completely.
What do you think?
Removing OpenSSL 1.0 support is fine with me but it would need a wider discussion. I'm CCing the development list. Thanks, Ilya
On Sun, Feb 26, 2023 at 8:20 AM Ilya Dryomov <idryomov@gmail.com> wrote:
On Sun, Feb 26, 2023 at 2:15 PM Patrick Schlangen <patrick@schlangen.me> wrote:
Hi Ilya,
Am 26.02.2023 um 14:05 schrieb Ilya Dryomov <idryomov@gmail.com>:
Isn't OpenSSL 1.0 long out of support? I'm not sure if extending librados API to support a workaround for something that went EOL over three years ago is worth it.
fair point. However, as long as ceph still supports compiling against OpenSSL 1.0 and has special code paths to initialize OpenSSL for versions <= 1.0, I think this should be fixed. The other option would be to remove OpenSSL 1.0 support completely.
What do you think?
Removing OpenSSL 1.0 support is fine with me but it would need a wider discussion. I'm CCing the development list.
Thanks,
Ilya _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
if librados still works with openssl 1.0 when you're not using it elsewhere in the process, i don't see a compelling reason to break that. maybe just add a #warning about it to librados.h?
participants (3)
-
Casey Bodley
-
Ilya Dryomov
-
Patrick Schlangen