Update OpenSSL

[alexey-milovidov]

Changelog category (leave one):

• Build/Testing/Packaging Improvement

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):
Update OpenSSL to upstream master. Fixed the issue when TLS connections may fail with the message OpenSSL SSL_read: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error and SSL Exception: error:2400006E:random number generator::error retrieving entropy. The issue was present in version 20.1.

Detailed description:
OpenSSL is using getrandom method on newer kernels and /dev/random on old kernels. The function getrandom from libc is linked if it is present and it compromises the portability of the built binary. If we just disable the getrandom method in configuration, OpenSSL will fallback to /dev/random which is also considered Ok. But in fact, on newer Linux kernels, /dev/random cannot provide sufficient amount of entropy (while getrandom guarantee to succeed). To fix this issue while maintaining portability, we refer getrandom not while static link stage but with dynamic symbol lookup (this method is also supported by OpenSSL). See the following patch: https://github.com/ClickHouse-Extras/openssl/pull/2/files

[filimonov]

Can we downgrade to 1.1.1 stable instead and wait for official 3.0.0 release (it's not even a beta yet)

https://www.openssl.org/blog/blog/2019/11/07/3.0-update/

[alexey-milovidov]

First I will finish this PR to see what will change.
It's urgent because we have TSan report in openssl/openssl#10379

Then we can consider downgrading.

[alexey-milovidov]

Update of OpenSSL did not solve the TSan report: https://clickhouse-test-reports.s3.yandex.net/8956/b4d3ed83403033bdb293bd40f7f9055a6cf0d711/functional_stateless_tests_(thread)/stderr.log

[alexey-milovidov]

Performance test Ok.

[alexey-milovidov]

01017_uniqCombined_memory_usage
01076_parallel_alter_replicated_zookeeper

• flacky tests.

[alexey-milovidov]

Update did not help.

[alexey-milovidov]

The issue is fixed. No errors after

for i in {1..1000000}; do echo -n "$i " && curl -k https://localhost:8443; done

[alexey-milovidov]

Cannot provide an automated test case.

It does not quickly reproduce even if I run

pv /dev/random > /dev/null

in parallel.

[alexey-milovidov]

Now I will try to replace it with version 1.1.1.