You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by GitBox <gi...@apache.org> on 2021/03/31 15:05:25 UTC

[GitHub] [hadoop] iwasakims opened a new pull request #2847: HADOOP-17609. Make SM4 support optional for OpenSSL native code.

iwasakims opened a new pull request #2847:
URL: https://github.com/apache/hadoop/pull/2847


   https://issues.apache.org/jira/browse/HADOOP-17609
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org


[GitHub] [hadoop] iwasakims commented on pull request #2847: HADOOP-17609. Make SM4 support optional for OpenSSL native code.

Posted by GitBox <gi...@apache.org>.
iwasakims commented on pull request #2847:
URL: https://github.com/apache/hadoop/pull/2847#issuecomment-811653214


   JceSm4CtrCryptoCodec instead of OpensslSm4CtrCryptoCodec is used for 'SM4/CTR/NoPadding' since SM4 is not enabled in openssl.
   ```
   $ openssl version
   OpenSSL 1.1.1g FIPS  21 Apr 2020
   $ openssl enc -ciphers | grep -i sm4
   
   $ bin/hadoop key create key-sm4 -cipher 'SM4/CTR/NoPadding'
   $ bin/hdfs dfs -mkdir /zone-sm4
   $ bin/hdfs crypto -createZone -path /zone-sm4 -keyName key-sm4
   $ bin/hdfs dfs -put README.txt /zone-sm4/
   2021-04-01 05:26:43,137 DEBUG util.NativeCodeLoader: Trying to load the custom-built native-hadoop library...
   2021-04-01 05:26:43,138 DEBUG util.NativeCodeLoader: Loaded the native-hadoop library
   2021-04-01 05:26:43,818 DEBUG util.PerformanceAdvisory: Both short-circuit local reads and UNIX domain socket are disabled.
   2021-04-01 05:26:44,447 DEBUG util.PerformanceAdvisory: Crypto codec org.apache.hadoop.crypto.OpensslSm4CtrCryptoCodec is not available.
   2021-04-01 05:26:44,447 DEBUG util.PerformanceAdvisory: Using crypto codec org.apache.hadoop.crypto.JceSm4CtrCryptoCodec.
   ...
   
   $ bin/hdfs dfs -cat README.txt /zone-sm4/README.txt
   2021-04-01 05:27:11,450 DEBUG util.NativeCodeLoader: Trying to load the custom-built native-hadoop library...
   2021-04-01 05:27:11,451 DEBUG util.NativeCodeLoader: Loaded the native-hadoop library
   2021-04-01 05:27:12,170 DEBUG util.PerformanceAdvisory: Both short-circuit local reads and UNIX domain socket are disabled.
   cat: `README.txt': No such file or directory
   2021-04-01 05:27:12,662 DEBUG kms.KMSClientProvider: KMSClientProvider created for KMS url: http://localhost:9600/kms/v1/ delegation token service: kms://http@localhost:9600/kms canonical service: 127.0.0.1:9600.
   2021-04-01 05:27:12,665 DEBUG kms.LoadBalancingKMSClientProvider: Created LoadBalancingKMSClientProvider for KMS url: kms://http@localhost:9600/kms with 1 providers. delegation token service: kms://http@localhost:9600/kms, canonical service: 127.0.0.1:9600
   2021-04-01 05:27:12,686 DEBUG util.PerformanceAdvisory: Crypto codec org.apache.hadoop.crypto.OpensslSm4CtrCryptoCodec is not available.
   2021-04-01 05:27:12,686 DEBUG util.PerformanceAdvisory: Using crypto codec org.apache.hadoop.crypto.JceSm4CtrCryptoCodec.
   ...
   
   For the latest information about Hadoop, please visit our website at:
   
      http://hadoop.apache.org/
   
   and our wiki, at:
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org


[GitHub] [hadoop] iwasakims closed pull request #2847: HADOOP-17609. Make SM4 support optional for OpenSSL native code.

Posted by GitBox <gi...@apache.org>.
iwasakims closed pull request #2847:
URL: https://github.com/apache/hadoop/pull/2847


   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org


[GitHub] [hadoop] iwasakims edited a comment on pull request #2847: HADOOP-17609. Make SM4 support optional for OpenSSL native code.

Posted by GitBox <gi...@apache.org>.
iwasakims edited a comment on pull request #2847:
URL: https://github.com/apache/hadoop/pull/2847#issuecomment-811652915


   OpensslAesCtrCryptoCodec is used for 'AES/CTR/NoPadding':
   ```
   $ bin/hadoop key create key-aes -cipher 'AES/CTR/NoPadding'
   $ bin/hdfs dfs -mkdir /zone-aes
   $ bin/hdfs crypto -createZone -path /zone-aes -keyName key-aes
   $ bin/hdfs dfs -put README.txt /zone-aes/
   2021-04-01 05:23:37,755 DEBUG util.NativeCodeLoader: Trying to load the custom-built native-hadoop library...
   2021-04-01 05:23:37,756 DEBUG util.NativeCodeLoader: Loaded the native-hadoop library
   2021-04-01 05:23:38,457 DEBUG util.PerformanceAdvisory: Both short-circuit local reads and UNIX domain socket are disabled.
   2021-04-01 05:23:39,072 DEBUG crypto.OpensslAesCtrCryptoCodec: Using org.apache.hadoop.crypto.random.OpensslSecureRandom as random number generator.
   2021-04-01 05:23:39,073 DEBUG util.PerformanceAdvisory: Using crypto codec org.apache.hadoop.crypto.OpensslAesCtrCryptoCodec.
   ...
   
   $ bin/hdfs dfs -cat /zone-aes/README.txt
   2021-04-01 05:23:52,844 DEBUG util.NativeCodeLoader: Trying to load the custom-built native-hadoop library...
   2021-04-01 05:23:52,845 DEBUG util.NativeCodeLoader: Loaded the native-hadoop library
   2021-04-01 05:23:53,549 DEBUG util.PerformanceAdvisory: Both short-circuit local reads and UNIX domain socket are disabled.
   2021-04-01 05:23:54,084 DEBUG kms.KMSClientProvider: KMSClientProvider created for KMS url: http://localhost:9600/kms/v1/ delegation token service: kms://http@localhost:9600/kms canonical service: 127.0.0.1:9600.
   2021-04-01 05:23:54,087 DEBUG kms.LoadBalancingKMSClientProvider: Created LoadBalancingKMSClientProvider for KMS url: kms://http@localhost:9600/kms with 1 providers. delegation token service: kms://http@localhost:9600/kms, canonical service: 127.0.0.1:9600
   2021-04-01 05:23:54,111 DEBUG crypto.OpensslAesCtrCryptoCodec: Using org.apache.hadoop.crypto.random.OpensslSecureRandom as random number generator.
   2021-04-01 05:23:54,111 DEBUG util.PerformanceAdvisory: Using crypto codec org.apache.hadoop.crypto.OpensslAesCtrCryptoCodec.
   ...
   For the latest information about Hadoop, please visit our website at:
   
      http://hadoop.apache.org/
   
   and our wiki, at:
   
   $ bin/hadoop checknative 2>/dev/null
   Native library checking:
   hadoop:  true /home/centos/dist/hadoop-3.4.0-SNAPSHOT-HADOOP-17609/lib/native/libhadoop.so.1.0.0
   zlib:    true /lib64/libz.so.1
   zstd  :  true /lib64/libzstd.so.1
   bzip2:   true /lib64/libbz2.so.1
   openssl: true /lib64/libcrypto.so
   ISA-L:   true /lib64/libisal.so.2
   PMDK:    false The native code was built without PMDK support.
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org


[GitHub] [hadoop] iwasakims edited a comment on pull request #2847: HADOOP-17609. Make SM4 support optional for OpenSSL native code.

Posted by GitBox <gi...@apache.org>.
iwasakims edited a comment on pull request #2847:
URL: https://github.com/apache/hadoop/pull/2847#issuecomment-811597921


   I manually tested the fix on CentOS 8 with bcprov-ext-jdk15on-168.jar set up based on [the comment of HDFS-15098](https://issues.apache.org/jira/browse/HDFS-15098?focusedCommentId=17112893&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-17112893). OpensslCipher is available but SM4 is not suppored. `hadoop key create key1 -cipher 'SM4/CTR/NoPadding'` worked (by falling back from OpensslSm4CtrCryptoCodec to JceSm4CtrCryptoCodec).
   
   ```
   $ grep Bouncy /usr/lib/jvm/java-1.8.0-openjdk/jre/lib/security/java.security
   security.provider.10=org.bouncycastle.jce.provider.BouncyCastleProvider
   
   $ bin/hadoop checknative 2>/dev/null
   Native library checking:
   hadoop:  true /home/centos/dist/hadoop-3.4.0-SNAPSHOT-HADOOP-17609/lib/native/libhadoop.so.1.0.0
   zlib:    true /lib64/libz.so.1
   zstd  :  true /lib64/libzstd.so.1
   bzip2:   true /lib64/libbz2.so.1
   openssl: true /lib64/libcrypto.so
   ISA-L:   true /lib64/libisal.so.2
   PMDK:    false The native code was built without PMDK support.
   
   $ bin/hadoop --daemon start kms
   $ bin/hadoop key create key1 -cipher 'SM4/CTR/NoPadding'
   2021-04-01 02:38:10,276 DEBUG kms.KMSClientProvider: KMSClientProvider created for KMS url: http://localhost:9600/kms/v1/ delegation token service: kms://http@localhost:9600/kms canonical service: 127.0.0.1:9600.
   2021-04-01 02:38:10,288 DEBUG kms.LoadBalancingKMSClientProvider: Created LoadBalancingKMSClientProvider for KMS url: kms://http@localhost:9600/kms with 1 providers. delegation token service: kms://http@localhost:9600/kms, canonical service: 127.0.0.1:9600
   2021-04-01 02:38:10,447 DEBUG kms.KMSClientProvider: Current UGI: centos (auth:SIMPLE)
   2021-04-01 02:38:10,450 DEBUG kms.KMSClientProvider: Login UGI: centos (auth:SIMPLE)
   key1 has been successfully created with options Options{cipher='SM4/CTR/NoPadding', bitLength=128, description='null', attributes=null}.
   org.apache.hadoop.crypto.key.kms.LoadBalancingKMSClientProvider@41e1e210 has been updated.
   ```
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org


[GitHub] [hadoop] iwasakims commented on pull request #2847: HADOOP-17609. Make SM4 support optional for OpenSSL native code.

Posted by GitBox <gi...@apache.org>.
iwasakims commented on pull request #2847:
URL: https://github.com/apache/hadoop/pull/2847#issuecomment-811652915


   OpensslAesCtrCryptoCodec is used for 'AES/CTR/NoPadding':
   ```
   $ bin/hadoop key create key-aes -cipher 'AES/CTR/NoPadding'
   $ bin/hdfs dfs -mkdir /zone-aes
   $ bin/hdfs crypto -createZone -path /zone-aes -keyName key-aes
   $ bin/hdfs dfs -put README.txt /zone-aes/
   2021-04-01 05:23:37,755 DEBUG util.NativeCodeLoader: Trying to load the custom-built native-hadoop library...
   2021-04-01 05:23:37,756 DEBUG util.NativeCodeLoader: Loaded the native-hadoop library
   2021-04-01 05:23:38,457 DEBUG util.PerformanceAdvisory: Both short-circuit local reads and UNIX domain socket are disabled.
   2021-04-01 05:23:39,072 DEBUG crypto.OpensslAesCtrCryptoCodec: Using org.apache.hadoop.crypto.random.OpensslSecureRandom as random number generator.
   2021-04-01 05:23:39,073 DEBUG util.PerformanceAdvisory: Using crypto codec org.apache.hadoop.crypto.OpensslAesCtrCryptoCodec.
   ...
   
   $ bin/hdfs dfs -cat /zone-aes/README.txt
   2021-04-01 05:23:52,844 DEBUG util.NativeCodeLoader: Trying to load the custom-built native-hadoop library...
   2021-04-01 05:23:52,845 DEBUG util.NativeCodeLoader: Loaded the native-hadoop library
   2021-04-01 05:23:53,549 DEBUG util.PerformanceAdvisory: Both short-circuit local reads and UNIX domain socket are disabled.
   2021-04-01 05:23:54,084 DEBUG kms.KMSClientProvider: KMSClientProvider created for KMS url: http://localhost:9600/kms/v1/ delegation token service: kms://http@localhost:9600/kms canonical service: 127.0.0.1:9600.
   2021-04-01 05:23:54,087 DEBUG kms.LoadBalancingKMSClientProvider: Created LoadBalancingKMSClientProvider for KMS url: kms://http@localhost:9600/kms with 1 providers. delegation token service: kms://http@localhost:9600/kms, canonical service: 127.0.0.1:9600
   2021-04-01 05:23:54,111 DEBUG crypto.OpensslAesCtrCryptoCodec: Using org.apache.hadoop.crypto.random.OpensslSecureRandom as random number generator.
   2021-04-01 05:23:54,111 DEBUG util.PerformanceAdvisory: Using crypto codec org.apache.hadoop.crypto.OpensslAesCtrCryptoCodec.
   ...
   For the latest information about Hadoop, please visit our website at:
   
      http://hadoop.apache.org/
   
   and our wiki, at:
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org


[GitHub] [hadoop] iwasakims closed pull request #2847: HADOOP-17609. Make SM4 support optional for OpenSSL native code.

Posted by GitBox <gi...@apache.org>.
iwasakims closed pull request #2847:
URL: https://github.com/apache/hadoop/pull/2847


   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org


[GitHub] [hadoop] hadoop-yetus commented on pull request #2847: HADOOP-17609. Make SM4 support optional for OpenSSL native code.

Posted by GitBox <gi...@apache.org>.
hadoop-yetus commented on pull request #2847:
URL: https://github.com/apache/hadoop/pull/2847#issuecomment-811296822


   :broken_heart: **-1 overall**
   
   
   
   
   
   
   | Vote | Subsystem | Runtime |  Logfile | Comment |
   |:----:|----------:|--------:|:--------:|:-------:|
   | +0 :ok: |  reexec  |   0m 54s |  |  Docker mode activated.  |
   |||| _ Prechecks _ |
   | +1 :green_heart: |  dupname  |   0m  0s |  |  No case conflicting files found.  |
   | +0 :ok: |  codespell  |   0m  1s |  |  codespell was not available.  |
   | +1 :green_heart: |  @author  |   0m  0s |  |  The patch does not contain any @author tags.  |
   | +1 :green_heart: |  test4tests  |   0m  0s |  |  The patch appears to include 2 new or modified test files.  |
   |||| _ trunk Compile Tests _ |
   | +1 :green_heart: |  mvninstall  |  32m 57s |  |  trunk passed  |
   | +1 :green_heart: |  compile  |  22m  5s |  |  trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04  |
   | +1 :green_heart: |  compile  |  18m 48s |  |  trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08  |
   | +1 :green_heart: |  checkstyle  |   1m  2s |  |  trunk passed  |
   | +1 :green_heart: |  mvnsite  |   1m 31s |  |  trunk passed  |
   | +1 :green_heart: |  javadoc  |   1m  5s |  |  trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04  |
   | +1 :green_heart: |  javadoc  |   1m 34s |  |  trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08  |
   | +1 :green_heart: |  spotbugs  |   2m 27s |  |  trunk passed  |
   | +1 :green_heart: |  shadedclient  |  15m 16s |  |  branch has no errors when building and testing our client artifacts.  |
   |||| _ Patch Compile Tests _ |
   | +1 :green_heart: |  mvninstall  |   0m 54s |  |  the patch passed  |
   | +1 :green_heart: |  compile  |  20m  8s |  |  the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04  |
   | -1 :x: |  cc  |  20m  8s | [/results-compile-cc-root-jdkUbuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2847/1/artifact/out/results-compile-cc-root-jdkUbuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04.txt) |  root-jdkUbuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04 with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04 generated 28 new + 329 unchanged - 28 fixed = 357 total (was 357)  |
   | +1 :green_heart: |  golang  |  20m  8s |  |  the patch passed  |
   | +1 :green_heart: |  javac  |  20m  8s |  |  the patch passed  |
   | +1 :green_heart: |  compile  |  18m  0s |  |  the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08  |
   | -1 :x: |  cc  |  18m  0s | [/results-compile-cc-root-jdkPrivateBuild-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08.txt](https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2847/1/artifact/out/results-compile-cc-root-jdkPrivateBuild-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08.txt) |  root-jdkPrivateBuild-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08 with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08 generated 42 new + 315 unchanged - 42 fixed = 357 total (was 357)  |
   | +1 :green_heart: |  golang  |  18m  0s |  |  the patch passed  |
   | +1 :green_heart: |  javac  |  18m  0s |  |  the patch passed  |
   | +1 :green_heart: |  blanks  |   0m  0s |  |  The patch has no blanks issues.  |
   | +1 :green_heart: |  checkstyle  |   1m  4s |  |  the patch passed  |
   | +1 :green_heart: |  mvnsite  |   1m 29s |  |  the patch passed  |
   | +1 :green_heart: |  javadoc  |   1m  2s |  |  the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04  |
   | +1 :green_heart: |  javadoc  |   1m 34s |  |  the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08  |
   | +1 :green_heart: |  spotbugs  |   2m 30s |  |  the patch passed  |
   | +1 :green_heart: |  shadedclient  |  15m 53s |  |  patch has no errors when building and testing our client artifacts.  |
   |||| _ Other Tests _ |
   | +1 :green_heart: |  unit  |  17m 27s |  |  hadoop-common in the patch passed.  |
   | +1 :green_heart: |  asflicense  |   0m 56s |  |  The patch does not generate ASF License warnings.  |
   |  |   | 179m  4s |  |  |
   
   
   | Subsystem | Report/Notes |
   |----------:|:-------------|
   | Docker | ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2847/1/artifact/out/Dockerfile |
   | GITHUB PR | https://github.com/apache/hadoop/pull/2847 |
   | Optional Tests | dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell cc golang |
   | uname | Linux f3983e6f5cbd 4.15.0-112-generic #113-Ubuntu SMP Thu Jul 9 23:41:39 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux |
   | Build tool | maven |
   | Personality | dev-support/bin/hadoop.sh |
   | git revision | trunk / 4bb500135c12382da8f9060398f3ca64208c6346 |
   | Default Java | Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08 |
   | Multi-JDK versions | /usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08 |
   |  Test Results | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2847/1/testReport/ |
   | Max. process+thread count | 1281 (vs. ulimit of 5500) |
   | modules | C: hadoop-common-project/hadoop-common U: hadoop-common-project/hadoop-common |
   | Console output | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2847/1/console |
   | versions | git=2.25.1 maven=3.6.3 spotbugs=4.2.2 |
   | Powered by | Apache Yetus 0.14.0-SNAPSHOT https://yetus.apache.org |
   
   
   This message was automatically generated.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org


[GitHub] [hadoop] iwasakims commented on pull request #2847: HADOOP-17609. Make SM4 support optional for OpenSSL native code.

Posted by GitBox <gi...@apache.org>.
iwasakims commented on pull request #2847:
URL: https://github.com/apache/hadoop/pull/2847#issuecomment-811597921


   I manually tested the fix on CentOS 8 with bcprov-ext-jdk15on-165.jar set up based on [the comment of HDFS-15098](https://issues.apache.org/jira/browse/HDFS-15098?focusedCommentId=17112893&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-17112893). OpensslCipher is available but SM4 is not suppored. `hadoop key create key1 -cipher 'SM4/CTR/NoPadding'` worked (by falling back from OpensslSm4CtrCryptoCodec to JceSm4CtrCryptoCodec).
   
   ```
   $ grep Bouncy /usr/lib/jvm/java-1.8.0-openjdk/jre/lib/security/java.security
   security.provider.10=org.bouncycastle.jce.provider.BouncyCastleProvider
   
   $ bin/hadoop checknative 2>/dev/null
   Native library checking:
   hadoop:  true /home/centos/dist/hadoop-3.4.0-SNAPSHOT-HADOOP-17609/lib/native/libhadoop.so.1.0.0
   zlib:    true /lib64/libz.so.1
   zstd  :  true /lib64/libzstd.so.1
   bzip2:   true /lib64/libbz2.so.1
   openssl: true /lib64/libcrypto.so
   ISA-L:   true /lib64/libisal.so.2
   PMDK:    false The native code was built without PMDK support.
   
   $ bin/hadoop --daemon start kms
   $ bin/hadoop key create key1 -cipher 'SM4/CTR/NoPadding'
   2021-04-01 02:38:10,276 DEBUG kms.KMSClientProvider: KMSClientProvider created for KMS url: http://localhost:9600/kms/v1/ delegation token service: kms://http@localhost:9600/kms canonical service: 127.0.0.1:9600.
   2021-04-01 02:38:10,288 DEBUG kms.LoadBalancingKMSClientProvider: Created LoadBalancingKMSClientProvider for KMS url: kms://http@localhost:9600/kms with 1 providers. delegation token service: kms://http@localhost:9600/kms, canonical service: 127.0.0.1:9600
   2021-04-01 02:38:10,447 DEBUG kms.KMSClientProvider: Current UGI: centos (auth:SIMPLE)
   2021-04-01 02:38:10,450 DEBUG kms.KMSClientProvider: Login UGI: centos (auth:SIMPLE)
   key1 has been successfully created with options Options{cipher='SM4/CTR/NoPadding', bitLength=128, description='null', attributes=null}.
   org.apache.hadoop.crypto.key.kms.LoadBalancingKMSClientProvider@41e1e210 has been updated.
   ```
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org