[MDEV-27540] Different OpenSSL versions mix up in build depending on cmake options Created: 2022-01-18  Updated: 2022-08-02  Resolved: 2022-01-20

Status: Closed
Project: MariaDB Server
Component/s: Compiling, SSL
Affects Version/s: N/A
Fix Version/s: 10.8.1, 10.5.17, 10.6.9, 10.7.5

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Sergei Golubchik
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-25785 Add support for OpenSSL 3.0 Closed

 Description   

It has probably always been so and affects all versions, just not as obvious as it is with OpenSSL 3. I didn't check existing main trees. Please update affects/fix versions as needed.

Building with WITH_SSL=<custom path> causes a version mix up:

preview-10.8-MDEV-25785-openssl3.0 7cd965af9

$ cmake . -DWITH_SSL=/home/elenst/openssl3-inst
...
-- Found OpenSSL: /usr/lib/x86_64-linux-gnu/libcrypto.so (found version "3.0.1")  
-- OPENSSL_INCLUDE_DIR = /home/elenst/openssl3-inst/include
-- OPENSSL_SSL_LIBRARY = /usr/lib/x86_64-linux-gnu/libssl.so
-- OPENSSL_CRYPTO_LIBRARY = /usr/lib/x86_64-linux-gnu/libcrypto.so
-- OPENSSL_VERSION = 3.0.1
-- SSL_LIBRARIES = /usr/lib/x86_64-linux-gnu/libssl.so;/usr/lib/x86_64-linux-gnu/libcrypto.so;dl
...
 
$ ls -l /usr/lib/x86_64-linux-gnu/libssl.so
lrwxrwxrwx 1 root root 13 Aug 24 11:28 /usr/lib/x86_64-linux-gnu/libssl.so -> libssl.so.1.1
 
$ make
/usr/bin/ld: CMakeFiles/mariadb_obj.dir/secure/openssl.c.o: in function `ma_tls_verify_server_cert':
/data/src/preview-10.8-MDEV-25785-openssl3.0-build-inst/libmariadb/libmariadb/secure/openssl.c:699: undefined reference to `SSL_get1_peer_certificate'
/usr/bin/ld: CMakeFiles/mariadb_obj.dir/secure/openssl.c.o: in function `ma_tls_get_finger_print':
/data/src/preview-10.8-MDEV-25785-openssl3.0-build-inst/libmariadb/libmariadb/secure/openssl.c:759: undefined reference to `SSL_get1_peer_certificate'
[ 20%] Built target GenFixPrivs
collect2: error: ld returned 1 exit status
make[2]: *** [libmariadb/libmariadb/CMakeFiles/libmariadb.dir/build.make:155: libmariadb/libmariadb/libmariadb.so.3] Error 1
make[1]: *** [CMakeFiles/Makefile2:4651: libmariadb/libmariadb/CMakeFiles/libmariadb.dir/all] Error 2
make[1]: *** Waiting for unfinished jobs....

Same happens with

cmake . -DWITH_SSL=/home/elenst/openssl3-inst -DSSL_PATH=/home/elenst/openssl3-inst/ -DOPENSSL_ROOT_DIR=/home/elenst/openssl3-inst -DOPENSSL_INCLUDE_DIR=/home/elenst/openssl3-inst/include/ 

This works:

cmake . -DWITH_SSL=/home/elenst/openssl3-inst -DOPENSSL_SSL_LIBRARY=/home/elenst/openssl3-inst/lib64/libssl.so -DOPENSSL_CRYPTO_LIBRARY=/home/elenst/openssl3-inst/lib64/libcrypto.so
 
-- Found OpenSSL: /home/elenst/openssl3-inst/lib64/libcrypto.so (found version "3.0.1")  
-- OPENSSL_INCLUDE_DIR = /home/elenst/openssl3-inst/include
-- OPENSSL_SSL_LIBRARY = /home/elenst/openssl3-inst/lib64/libssl.so
-- OPENSSL_CRYPTO_LIBRARY = /home/elenst/openssl3-inst/lib64/libcrypto.so
-- OPENSSL_VERSION = 3.0.1
-- SSL_LIBRARIES = /home/elenst/openssl3-inst/lib64/libssl.so;/home/elenst/openssl3-inst/lib64/libcrypto.so;dl



 Comments   
Comment by Vladislav Vaintroub [ 2022-01-19 ]

I did not remember there is -DWITH_SSL=path , but it seems to be own invention for something that is already available in standard CMake.

The official way to tell cmake the directory of custom OpenSSL is -DOPENSSL_ROOT_DIR, and this is what I used, together with WITH_SSL=system (to trigger FIND_PACKAGE(OpenSSL)).

The variable is listed under HINTS in CMake documentation in https://cmake.org/cmake/help/v3.22/module/FindOpenSSL.html

Here is how I used it https://github.com/MariaDB/server/commit/2cc5fa65d34a566e7c1a046d5f61c95b357664d2

Comment by Elena Stepanova [ 2022-01-19 ]

Please see the description:

Same happens with

cmake . -DWITH_SSL=/home/elenst/openssl3-inst -DSSL_PATH=/home/elenst/openssl3-inst/ -DOPENSSL_ROOT_DIR=/home/elenst/openssl3-inst -DOPENSSL_INCLUDE_DIR=/home/elenst/openssl3-inst/include/

And yes, same also happens with -DOPENSSL_ROOT_DIR -DWITH_SSL=system, without other parameters:

-- Found OpenSSL: /usr/lib/x86_64-linux-gnu/libcrypto.so (found version "3.0.1")  
-- OPENSSL_INCLUDE_DIR = /home/elenst/openssl3-inst/include
-- OPENSSL_SSL_LIBRARY = /usr/lib/x86_64-linux-gnu/libssl.so
-- OPENSSL_CRYPTO_LIBRARY = /usr/lib/x86_64-linux-gnu/libcrypto.so
-- OPENSSL_VERSION = 3.0.1
-- SSL_LIBRARIES = /usr/lib/x86_64-linux-gnu/libssl.so;/usr/lib/x86_64-linux-gnu/libcrypto.so;dl

If you mean Windows, I have no information about any mixup there. My Windows doesn't have alternative openssl installations.

Comment by Vladislav Vaintroub [ 2022-01-19 ]

I did not mean Windows , but since you mentioned it, I can report that, that there exists Appveyor environment, accessible to general public, with 3 versions of openssl 1.1.0, 1.1.1 and 3.0 installed side-by-side (s. https://www.appveyor.com/docs/windows-images-software/)

There, -DWITH_SSL=system -DOPENSSL_ROOT_DIR=C:\path\specific\to\openssl-version alone does help.

Comment by Elena Stepanova [ 2022-01-19 ]

I did not mean Windows

So, it worked for you on Linux, then? Which Linux, which cmake? I had the above with at least cmake 3.18.4, maybe others but I don't have other versions handy. If you are saying that it works somewhere, I can check.

> My Windows doesn't have alternative openssl installations.

since you mentioned it, I can report that, that there exists Appveyor environment, accessible to general public, with 3 versions of openssl 1.1.0, 1.1.1 and 3.0

I didn't mean custom installations, I meant having a "default" one while trying to build with non-default, as will be very common on Linuxes for the next many months at least. Getting rid of the default installation of openSSL libraries on Linux seems difficult, at least I couldn't manage it without removing what seems to be a half of the system.
For custom ones, sure, I have several of those on my Windows/Linux machines as well. But naturally installations in non-default locations are extremely unlikely to interfere since cmake wouldn't know anything about them.
I don't know if there is a "default" location for Windows which cmake can try to search. Given that FindOpenSSL.cmake is partially split into separate "Windows/Linux" paths, it wouldn't be surprising if it worked very differently on Linux vs Windows at the end.

Comment by Vladislav Vaintroub [ 2022-01-19 ]

On Linux, I did not ever test mix of default and custom openssl. My reports about OPENSSL_ROOT_DIR working are based only on by primary build environment. On Linux, IIRC, I uninstalled default, and "sudo make installed" the 3.0 to get it working.

Comment by Sergei Golubchik [ 2022-01-20 ]

it's a cmake bug, fixed in 3.23.0. We'll have to implement a workaround.

Comment by Sergei Golubchik [ 2022-01-20 ]

pushed in a preview branch

Generated at Thu Feb 08 09:53:41 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.