search

secondlife / viewer

🖥️ Second Life's official client
GNU Lesser General Public License v2.1
211 stars 53 forks source link

Update CURL and OpenSSL (OpenSSL 1.1.1 End of Life) #870

Open AiraYumi opened 8 months ago

AiraYumi commented 8 months ago

OpenSSL 1.1.1 ended support on September 11, 2023. Are there any plans to update to 3.1 which is LTS?

vldevel commented 8 months ago

The problem is that the current (super-old) libcurl version in use by the viewer is one patched to properly work with HTTP pipelining, and all newer versions won't support it... Since this old version relies on OpenSSL v1.1.1, we'd first need to do without HTTP pipelining in SL (which helps a lot in loading/rezzing the textures and meshes faster, especially for oversea user where the "ping" time would otherwise badly impact HTTP requests delays in non-pipelining mode). One (partial) solution would be to get SL servers and the SL CDNs configured for HTTP/2, and then we could use the current version of libcurl together with the current version of OpenSSL.

larsnaesbye commented 8 months ago

The problem is that the current (super-old) libcurl version in use by the viewer is one patched to properly work with HTTP pipelining, and all newer versions won't support it... Since this old version relies on OpenSSL v1.1.1, we'd first need to do without HTTP pipelining in SL (which helps a lot in loading/rezzing the textures and meshes faster, especially for oversea user where the "ping" time would otherwise badly impact HTTP requests delays in non-pipelining mode). One (partial) solution would be to get SL servers and the SL CDNs configured for HTTP/2, and then we could use the current version of libcurl together with the current version of OpenSSL.

HTTP/2 (or even the faster and UDP-based HTTP/3) would definitely be cool to have implemented.

yaynstuff commented 8 months ago

Amazon's CDN (Cloudfront) supports HTTP/2 already.

yaynstuff commented 8 months ago

There are also likely significant OpenSSL API changes from 1.1 -> 3.1 which would need work on the viewer side to work correctly (we saw this sort of thing already back in the past when there was a shift from the older version of OpenSSL over to 1.1).

AiraYumi commented 7 months ago

Since 3.0, the ENGINE_* functions have been deprecated, so you must use the alternative functions.

AiraYumi commented 7 months ago

Although it is a temporary situation for testing, the build passed. There are still issues with actual operation, but I think it can be used to test viewer builds.

https://github.com/AiraYumi/3p-openssl/releases/tag/v3.0.12_testing

https://github.com/AiraYumi/3p-openssl/releases/tag/v3.1.5_testing

https://github.com/AiraYumi/3p-openssl/releases/tag/v3.2.1_testing

AiraYumi commented 6 months ago

I am testing to update to version 3.3.0, but the version information could not be obtained only when using Windows.

https://github.com/AiraYumi/3p-openssl/actions/runs/8699199697

yaynstuff commented 6 months ago

I'd probably just wait for LL to deal with this and leave it - because LL are using a rather crusty version of curl which also relies on an older version of OpenSSL... LL have their reasons for using that old version (http pipelining, which is kinda sad, and obsolete).. This crusty version of curl used by LL needs to be linked against the same version of OpenSSL that the viewer is using - I am willing to wager that the crusty old version of curl that is being used wont be able to be linked against openssl 3.x, it also will require an update to curl first.