make results in "../lib//libs2n.so: undefined reference to `EVP_DecryptFinal_ex'"

[sanderjo]

On a clean Ubuntu 14.04, with a uptodate git version of s2n, the commands

apt-get update
apt-get upgrade
apt-get install git build-essential openssl libssl-dev
git clone https://github.com/awslabs/s2n.git
cd s2n/
make clean
make

result in the errors below. Tips how to solve this are welcome.

<snip>
make -C bin
make[1]: Entering directory `/git/s2n/bin'
cc -pedantic -Wall -Werror -Wimplicit -Wunused -Wcomment -Wchar-subscripts -Wuninitialized -Wshadow -Wcast-qual -Wcast-align -Wwrite-strings -Wstack-protector -fPIC -std=c99 -D_POSIX_C_SOURCE=200112L -fstack-protector-all -O2 -I../libcrypto-root/include/ -I../api/ -I../ -Wno-deprecated-declarations -Wno-unknown-pragmas -Wformat-security -D_FORTIFY_SOURCE=2 s2nc.c echo.c  -o s2nc -L../lib/ -ls2n -ldl -lrt -lpthread
../lib//libs2n.so: undefined reference to `EVP_DecryptFinal_ex'
../lib//libs2n.so: undefined reference to `SHA224_Update'
../lib//libs2n.so: undefined reference to `ENGINE_free'
../lib//libs2n.so: undefined reference to `EC_KEY_set_public_key'
../lib//libs2n.so: undefined reference to `DHparams_dup'
../lib//libs2n.so: undefined reference to `SHA384_Init'
../lib//libs2n.so: undefined reference to `RSA_public_encrypt'
../lib//libs2n.so: undefined reference to `ENGINE_set_default'
../lib//libs2n.so: undefined reference to `EVP_aes_128_gcm'
../lib//libs2n.so: undefined reference to `ENGINE_set_init_function'
../lib//libs2n.so: undefined reference to `MD5_Final'
../lib//libs2n.so: undefined reference to `ENGINE_init'
../lib//libs2n.so: undefined reference to `RSA_size'
../lib//libs2n.so: undefined reference to `EVP_aes_256_cbc'
../lib//libs2n.so: undefined reference to `ENGINE_set_flags'
../lib//libs2n.so: undefined reference to `EC_KEY_get0_public_key'
../lib//libs2n.so: undefined reference to `ENGINE_add'
../lib//libs2n.so: undefined reference to `BN_num_bits'
../lib//libs2n.so: undefined reference to `RC4'
../lib//libs2n.so: undefined reference to `BN_bin2bn'
../lib//libs2n.so: undefined reference to `RSA_free'
../lib//libs2n.so: undefined reference to `EVP_PKEY_free'
../lib//libs2n.so: undefined reference to `EC_POINT_oct2point'
../lib//libs2n.so: undefined reference to `SHA384_Update'
../lib//libs2n.so: undefined reference to `ENGINE_new'
../lib//libs2n.so: undefined reference to `SHA224_Init'
../lib//libs2n.so: undefined reference to `SHA256_Init'
../lib//libs2n.so: undefined reference to `SHA512_Update'
../lib//libs2n.so: undefined reference to `d2i_RSAPrivateKey'
../lib//libs2n.so: undefined reference to `EVP_CIPHER_CTX_init'
../lib//libs2n.so: undefined reference to `DH_new'
../lib//libs2n.so: undefined reference to `BN_free'
../lib//libs2n.so: undefined reference to `EC_KEY_generate_key'
../lib//libs2n.so: undefined reference to `EVP_EncryptUpdate'
../lib//libs2n.so: undefined reference to `X509_get_pubkey'
../lib//libs2n.so: undefined reference to `DH_free'
../lib//libs2n.so: undefined reference to `EC_KEY_get0_group'
../lib//libs2n.so: undefined reference to `EVP_aes_128_ecb'
../lib//libs2n.so: undefined reference to `EVP_CIPHER_CTX_set_padding'
../lib//libs2n.so: undefined reference to `EVP_PKEY_get1_RSA'
../lib//libs2n.so: undefined reference to `SHA1_Update'
../lib//libs2n.so: undefined reference to `RSA_verify'
../lib//libs2n.so: undefined reference to `ENGINE_set_name'
../lib//libs2n.so: undefined reference to `EVP_DecryptInit_ex'
../lib//libs2n.so: undefined reference to `RC4_set_key'
../lib//libs2n.so: undefined reference to `EVP_EncryptFinal_ex'
../lib//libs2n.so: undefined reference to `d2i_DHparams'
../lib//libs2n.so: undefined reference to `DH_compute_key'
../lib//libs2n.so: undefined reference to `DH_generate_key'
../lib//libs2n.so: undefined reference to `BN_bn2bin'
../lib//libs2n.so: undefined reference to `SHA512_Final'
../lib//libs2n.so: undefined reference to `EVP_EncryptInit_ex'
../lib//libs2n.so: undefined reference to `EC_POINT_point2oct'
../lib//libs2n.so: undefined reference to `EVP_CIPHER_CTX_ctrl'
../lib//libs2n.so: undefined reference to `ENGINE_set_id'
../lib//libs2n.so: undefined reference to `EVP_aes_256_gcm'
../lib//libs2n.so: undefined reference to `DH_size'
../lib//libs2n.so: undefined reference to `EVP_aes_128_cbc'
../lib//libs2n.so: undefined reference to `SHA256_Final'
../lib//libs2n.so: undefined reference to `SHA1_Init'
../lib//libs2n.so: undefined reference to `SHA224_Final'
../lib//libs2n.so: undefined reference to `EC_KEY_free'
../lib//libs2n.so: undefined reference to `X509_free'
../lib//libs2n.so: undefined reference to `EVP_des_ede3_cbc'
../lib//libs2n.so: undefined reference to `d2i_X509'
../lib//libs2n.so: undefined reference to `SHA256_Update'
../lib//libs2n.so: undefined reference to `RSA_sign'
../lib//libs2n.so: undefined reference to `EC_GROUP_get_degree'
../lib//libs2n.so: undefined reference to `EVP_DecryptUpdate'
../lib//libs2n.so: undefined reference to `MD5_Init'
../lib//libs2n.so: undefined reference to `ENGINE_set_RAND'
../lib//libs2n.so: undefined reference to `MD5_Update'
../lib//libs2n.so: undefined reference to `EC_POINT_free'
../lib//libs2n.so: undefined reference to `EC_POINT_new'
../lib//libs2n.so: undefined reference to `RSA_private_decrypt'
../lib//libs2n.so: undefined reference to `ECDH_compute_key'
../lib//libs2n.so: undefined reference to `SHA1_Final'
../lib//libs2n.so: undefined reference to `EC_KEY_new_by_curve_name'
../lib//libs2n.so: undefined reference to `ENGINE_by_id'
../lib//libs2n.so: undefined reference to `EVP_CIPHER_CTX_cleanup'
../lib//libs2n.so: undefined reference to `SHA512_Init'
collect2: error: ld returned 1 exit status
make[1]: *** [s2nc] Error 1
make[1]: Leaving directory `/git/s2n/bin'
make: *** [bin] Error 2

The file /usr/include/openssl/evp.h is there:

# grep -irn EVP_DecryptFinal_ex *
crypto/s2n_aead_cipher_aes_gcm.c:103:    if (EVP_DecryptFinal_ex(&key->native_format.evp_cipher_ctx, out_data, &out_len) != 1) {

# grep -irn EVP_DecryptFinal_ex /usr/include/
/usr/include/openssl/evp.h:596:int      EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
/usr/include/openssl/evp.h:1274:#define EVP_F_EVP_DECRYPTFINAL_EX                        101

[sanderjo]

Update: In bin/Makefile I changed

    LIBS = -ldl -lrt -lpthread

to

    LIBS = -ldl -lrt -lpthread -lcrypto

and then the make goes well ... up until the tests:

make[2]: Entering directory `/git/s2n/tests/unit'
Running s2n_3des_test.c                                    ... PASSED      27245 tests

Running s2n_aead_aes_test.c                                ... PASSED   49579370 tests
Running s2n_aes_test.c                                     ... PASSED      54184 tests
Running s2n_cbc_verify_test.c                              ... PASSED    8641804 tests
Running s2n_cipher_suite_match_test.c                      ... PASSED          4 tests
Running s2n_client_disabled_test.c                         ... PASSED          4 tests
Running s2n_client_extensions_test.c                       ... FAILED test 170
!((client_conn = s2n_connection_new(S2N_CLIENT)) == (((void *)0))) is not true  (s2n_client_extensions_test.c line 470)
Error Message: 'error calling mlock'
make[2]: *** [s2n_client_extensions_test] Error 1
make[2]: Leaving directory `/git/s2n/tests/unit'
make[1]: *** [all] Error 2
make[1]: Leaving directory `/git/s2n/tests'
make: *** [all] Error 2

[mehlis]

can reproduce this problem on my Fedora, your fix is working for me, too.

Test is aborts with:

make[2]: Entering directory '/home/c/git/public/s2n/tests/unit'
Running s2n_record_test.c                                  ... PASSED     179816 tests
Running s2n_stuffer_hex_test.c                             ... PASSED        317 tests
Running s2n_aes_test.c                                     ... PASSED      54184 tests
Running s2n_stuffer_base64_test.c                          ... PASSED        465 tests
Running s2n_handshake_test.c                               ... FAILED test 43
!((server_conn = s2n_connection_new(S2N_SERVER)) == (((void *)0))) is not true  (s2n_handshake_test.c line 136)
Error Message: 'error calling mlock'

[colmmacc]

This failure is likely because the ulimits on the amount of memory that may be locked are too low for the tests to pass.

[sanderjo]

@colmmacc I re-ran on a 4GB system (instead of on a 1 - 2GB RAM docker container), and with the Makefile patch ... all tests pass! So your memory statement seems correct.

[sanderjo]

Pull request sent for bin/Makefile

[anatol]

I have the same compilation issue at Linux Arch. This bug is closed but I do not see that the proposed fix is submitted to trunk.

Any plans to submit the actual fix?

[colmmacc]

Reading the first report in this thread it looks like an attempt to build against the system version of OpenSSL rather than a bundled static libcrypto.a. The problem is that libs2n.so hasn't included libcrypto.a , which is pretty important.

Is there a good recipe to ensure that libs2n is linked against the system libcrypto.a if that's what you'd like to do?