{"record":{"id":"07d478919c1ae272","repo":"apache/hadoop","slug":"the-openssl-native-library-is-built-without-sm4-ct","errorCode":null,"errorMessage":"The OpenSSL native library is built without SM4 CTR support","messagePattern":"The OpenSSL native library is built without SM4 CTR support","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/OpensslSm4CtrCryptoCodec.java","lineNumber":46,"sourceCode":"import static org.apache.hadoop.fs.CommonConfigurationKeysPublic.HADOOP_SECURITY_OPENSSL_ENGINE_ID_KEY;\n\n/**\n * Implement the SM4-CTR crypto codec using JNI into OpenSSL.\n */\n@InterfaceAudience.Private\npublic class OpensslSm4CtrCryptoCodec extends OpensslCtrCryptoCodec {\n\n  private static final Logger LOG =\n          LoggerFactory.getLogger(OpensslSm4CtrCryptoCodec.class.getName());\n\n  public OpensslSm4CtrCryptoCodec() {\n    String loadingFailureReason = OpensslCipher.getLoadingFailureReason();\n    if (loadingFailureReason != null) {\n      throw new RuntimeException(loadingFailureReason);\n    }\n\n    if (!OpensslCipher.isSupported(CipherSuite.SM4_CTR_NOPADDING)) {\n      throw new RuntimeException(\"The OpenSSL native library is built without SM4 CTR support\");\n    }\n  }\n\n  @Override\n  public Logger getLogger() {\n    return LOG;\n  }\n\n  @Override\n  public void setConf(Configuration conf) {\n    super.setConf(conf);\n    setEngineId(conf.get(HADOOP_SECURITY_OPENSSL_ENGINE_ID_KEY));\n  }\n\n  @Override\n  public CipherSuite getCipherSuite() {\n    return CipherSuite.SM4_CTR_NOPADDING;\n  }","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/OpensslSm4CtrCryptoCodec.java#L28-L64","documentation":"OpensslSm4CtrCryptoCodec's constructor verifies at instantiation that the loaded native OpenSSL library actually implements SM4 in CTR mode (OpensslCipher.isSupported). If the JNI bridge loaded fine but the underlying OpenSSL build lacks SM4-CTR, the codec throws a RuntimeException immediately, so it never gets selected as a usable codec.","triggerScenarios":"Constructing OpensslSm4CtrCryptoCodec (directly, or via CryptoCodec.getInstance when hadoop.security.crypto.cipher.suite=SM4/CTR/NoPadding) on a node whose libhadoop/OpenSSL native library was built without SM4 support — e.g. OpenSSL 1.0.x, older distro builds, or FIPS builds that disable SM4.","commonSituations":"Enabling SM4 encryption zones after a cluster was built with older OpenSSL; rolling upgrades where some DataNodes have new native libs and some do not; container images built on older base distros","solutions":["Upgrade the Hadoop native library and OpenSSL to a build with SM4-CTR support (OpenSSL 1.1.1+ typically) on every node","Fall back to AES/CTR/NoPadding, which nearly every OpenSSL build supports","Gate on OpensslCipher.isSupported(CipherSuite.SM4_CTR_NOPADDING) before configuring SM4 cluster-wide","Confirm which native library is actually loaded via the native library load logs at startup"],"exampleFix":"// before\nconf.set(\"hadoop.security.crypto.cipher.suite\", \"SM4/CTR/NoPadding\");\nCryptoCodec codec = CryptoCodec.getInstance(conf); // RuntimeException: no SM4 CTR support\n\n// after\nif (OpensslCipher.isSupported(CipherSuite.SM4_CTR_NOPADDING)) {\n  conf.set(\"hadoop.security.crypto.cipher.suite\", \"SM4/CTR/NoPadding\");\n} else {\n  conf.set(\"hadoop.security.crypto.cipher.suite\", \"AES/CTR/NoPadding\");\n}\nCryptoCodec codec = CryptoCodec.getInstance(conf);","handlingStrategy":"fallback","validationCode":"// Probe native SM4 support before configuring it\nboolean sm4Ok = OpensslCipher.isSupported(CipherSuite.SM4_CTR_NOPADDING);\nString suite = sm4Ok ? \"SM4/CTR/NoPadding\" : \"AES/CTR/NoPadding\";\nconf.set(\"hadoop.security.crypto.cipher.suite\", suite);","typeGuard":"public boolean nodeSupportsSm4() {\n  return OpensslCipher.isSupported(CipherSuite.SM4_CTR_NOPADDING);\n}","tryCatchPattern":"try {\n  codec = new OpensslSm4CtrCryptoCodec();\n} catch (RuntimeException e) {\n  // native lib lacks SM4 CTR — fall back to AES\n  LOG.warn(\"SM4 unavailable ({}); falling back to AES/CTR\", e.getMessage());\n  conf.set(\"hadoop.security.crypto.cipher.suite\", \"AES/CTR/NoPadding\");\n  codec = CryptoCodec.getInstance(conf);\n}","preventionTips":["Gate cluster-wide SM4 enablement on a node-level capability check across the fleet","Keep native libhadoop and OpenSSL versions uniform during rolling upgrades","Watch native-library load logs at startup to know exactly which build is active"],"tags":["crypto","openssl","sm4","native-library","codec"],"backgroundTag":"native-library-unsupported-algorithm","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}