6

Platform: Ubuntu 12.04LTS x86_64
Python version: 2.7.3

I have a shared library that was given to me by a vendor, and it included libcrypto.so.0.9.8 and libssl.0.9.8 with a note stating that it would not work with other versions of those libraries.

The version of Ubuntu that we run (12.04LTS) uses libcrypto.so.1.0.0 and libssl.so.1.0.0, and I attempted to compile against those, and confirmed that it doesn't work.

I proceeded to write my C function, and test it compiling against the given libraries, and it works, everything's happy, I get the results back I expect, so forth and so on. Here's where it gets sticky. When I import the function into python, and try to run it, it appears that ld.so is still trying to link it to libcrypto.so.1.0.0, instead of the library specified.

I've copied all of the libraries into /etc/directory (renamed for post) to create a consistent place to put these when it's implemented on other servers.

I'm compiling with:

gcc -fPIC -shared vendor_lib_test.c -o libmylib.so -lvendor_ssl

aditional gcc options I've tried are:

-Wl,-rpath,/etc/directory,-rpath-link,/etc/directory  #together, and each individually
-Wl,-R,/etc/directory/libssl.so.0.9.8,-R,/etc/directory/libcrypto.so.0.9.8 #both with, and without the above

I tried running the code on an older server running 10.04LTS, which uses 0.9.8 of both of those libraries, and it worked as expected, but it's the last 10.04 server we have, and will not be used in production.

checking against ldd produces (edited to remove sensitive info):

linux-vdso.so.1 =>  (0x00007fff39fe9000)
libvendor_ssl.so => /etc/directory/liblpcapi_ssl.so (0x00007f3c7602b000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3c75c64000)
libssl.so.0.9.8 => /etc/directory/libssl.so.0.9.8 (0x00007f3c75b1c000)
libcrypto.so.0.9.8 => /etc/directory/libcrypto.so.0.9.8 (0x00007f3c758ab000)
/lib64/ld-linux-x86-64.so.2 (0x00007f3c76341000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f3c756a7000)

so it appears to be linked to the correct libraries, but running the python script produces a segmentation fault, and gdb gives us:

$ gdb python
(gdb) run ./ptest.py
Starting program: /usr/bin/python ./ptest.py
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff724dc68 in RSA_public_encrypt () from /lib/x86_64-linux-gnu/libcrypto.so.1.0.0

so it's still trying to link against 1.0.0, I'm banging my head against the wall here.

edit: export LD_LIBRARY_PATH=/etc/directory did not work either.

5
  • 1
    After loading your library with ctypes, take a look at the output of os.system('pmap %d' % os.getpid()) to see which versions are loaded. Also check readelf -d libmylib.so and readelf -d libvendor_ssl.so for the NEEDED versions and the RPATH or RUNPATH values.
    – Eryk Sun
    Jun 28, 2013 at 19:32
  • Thank you for your comment. pmap shows 0.9.8 of both libraries loading, followed by 1.0.0 for both of them. readelf shows 0.9.8 for both on the vendor library, with no RPATH. readelf shows RPATH Library path: [/etc/directory] on my library Jun 28, 2013 at 19:36
  • It would appear that python loads 1.0.0 all on it's own. If you simply import os, and print os.system('pmap %d' % os.getpid()) it shows libcrypto.1.0.0 loaded. Any ideas on a workaround? Jun 28, 2013 at 20:09
  • 1
    Check the output of nm libvendor_ssl.so to see if it uses the versioned symbols, such as RSA_public_encrypt@@OPENSSL_0.9.8. It looks like it doesn't. Python's _ssl module does.
    – Eryk Sun
    Jun 28, 2013 at 20:37
  • That looks to be exactly the case. :( I might have to throw up a server with 10.04 on it, just to run this. The alternative is to write the entire thing is C, which would effectively shut out the rest of our developers, but I could build it as a server, with an XML-RPC/SOAP interface I suppose. Jun 28, 2013 at 21:10

1 Answer 1

0

There is an undocumented parameter to gcc that allows you to set a path to a shared library: "-l:/usr/libname.so".

Maybe ld will do what you want if you pass complete lib name to gcc, and you'll be able to run a choosen version of the library, e.g.: gcc (...) -l:/etc/directory/libssl.0.9.8 -l:/etc/directory/libcrypto.so.0.9.8

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.