Date: Sat, 04 Jan 2020 15:21:06 -0600 From: Mike Karels <mike@karels.net> To: Alexander Koeppe <format_c@online.de> Cc: freebsd-stable@freebsd.org Subject: Re: FreeBSD SSL libraries and OpenSSL libraries - how to compile own source code Message-ID: <202001042121.004LL6sJ062282@mail.karels.net> In-Reply-To: Your message of Fri, 03 Jan 2020 15:16:35 %2B0100. <qunic4$3ntq$1@blaine.gmane.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Not having seen an answer to this yet, I'm going to provide a partial answer. Hopefully someone plugged into the current plans can provide the rest, especially where ports are going with this. > To: freebsd-stable@freebsd.org > From: Alexander Koeppe <format_c@online.de> > Hello list, > Since I've upgraded to FreeBSD 12, I've linker issues when I try to > build my own source code which is depending on OpenSSL library. > It's claiming that there are undefined references to SSL_library_init or > SSLv23_server_method for instance. The linker is correct; see below. > I detected the OpenSSL libraries using the FindOpenSSL.cmake file in > /usr/local/share/cmake/Modules. It returned /usr/lib32/libssl.so and > /usr/lib32/libcrypto.so. > Cmake is for some reason translating the found libraries to the `-lssl` > and `-lcrypto` linker flags. This seem to default back to > /usr/lib/libssl.so and /usr/lib/libcrypto.so. > These files point by default to: > /usr/lib/libssl.so -> libssl.so.111 > /usr/lib/libcrypto.so -> /lib/libcrypto.so.111 Those are the shared libraries used by the base. They are from OpenSSL 1.1.1. > But when I check which libraries have been provided by OpenSSL package, > I get a different outcome: > $ pkg list openssl | egrep 'lib(ssl|crypto).so' > /usr/local/lib/libcrypto.so > /usr/local/lib/libcrypto.so.9 > /usr/local/lib/libssl.so > /usr/local/lib/libssl.so.9 > $ > These files are different to what openssl package provided. These are the libraries used by ports (packages). > When I replace these symlinks to point to the .so files provided by the > openssl package, building and running the application works as expected. So: > /usr/lib/libssl.so -> /usr/local/lib/libssl.so > /usr/lib/libcrypto.so -> /usr/local/lib/libcrypto.so > I've read that FreeBSD 12 provides it's own SSL libraries and there is > the possibility to edit the /etc/make.conf to make the ports building > against the "real" OpenSSL library. FreeBSD 12 uses OpenSSL 1.1.1 in the base (not its own SSL libraries). However, ports were not converted to 1.1.1 at that time, but instead use the /usr/local version (which I think is OpenSSL 1.0.2t as of 12.1). Changing the symlinks in /usr/lib will cause newly-compiled programs to use the old version, but will probably also prevent part of the base system from being recompiled/linked. The include paths are different as well. However, note that OpenSSL 1.0.2 is no longer supported upstream, even for security fixes, as of the new year. OpenSSL 1.1.1 is quite different than past versions. For example, SSL v2 is gone (hence entry points like SSLv23_server_method; I've forgotten what the replacement is). Many data structures have been made opaque, requiring the use of accessor functions. I have spent the best part of the last month retrofitting our own software at $WORK. > However I often need to build the latest source code from GitHub, so > that I cannot make use of the ports approach (I tend to use the pkg > management). > What is the best way to use the "real" OpenSSL libraries when building > custom source code on FreeBSD? The "best" approach is to convert your code to use OpenSSL 1.1.1, or to find versions of external source that have been converted. OpenSSL 1.0.2 may still be usable for a while in some environments, but is not a good path going forward. Alternatively, I assume it is still possible to compile using the ports environment by using the right -I and -L options to use the 1.0.2 headers and libraries in /usr/local. > Thanks in advance for any advice. Good luck! > - Alex Mike
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202001042121.004LL6sJ062282>