On Monday, October 3, 2022 5:33 AM
Darren Tucker <dtucker at dtucker.net> wrote:>On Fri, 30 Sept 2022 at 02:23, Val Baranov <val.baranov at duke.edu>
wrote:
>> For a number of releases since introducing OpenSSH ver. 8, AIX
experiencing a problem configuring OpenSSH with static OpenSSL libs ver.
1.1.1.(x).
>The thing that changed is that your libcrypto is now built to link against
pthreads whereas previously it was not. It's not a change in OpenSSH
itself.
>> Looks like it is a sort of misleading info provided by
"configure" output by displaying the error with "libcrypto"
while in fact "config.log" contains lines with ".pthread"
errors just before "libcrypto" error (could it be a 'side'
effect of ".pthread" symbols being not found - ?).
>> ld: 0711-317 ERROR: Undefined symbol: .pthread_atfork
>This means that the little test program configure tried to build failed when
linking because the pthreads functions were not available to it. Configure
itself does not know why >it failed, just that it failed. That was resolved
when you added -lpthreads to LDFLAGS.
>As it stands, configure does not know that libcrypto needs pthreads.
>The usual way of dealing with this is pkg-config, which reads that data from
.pc files, although OpenSSH does not currently use that for OpenSSL. You may
find there's a libcrypto.pc file in there somewhere with lines something
like:
>Libs: -L${libdir} -lcrypto
>Libs.private: -lz -ldl -pthread
>although you may not, as my understanding is that even modern AIX does not
have pkg-config (certainly the ancient versions I am familiar with do not).
>We should probably tell configure to use pkg-config for OpenSSL, but
that's a non-trivial change (even with the recent simplifications done with
the OpenSSL configure bits), it won't help if you don't have pkg-config
and it'd have to go in early in the next release cycle anyway.
>Is your libcrypto part of the base OS, in /opt/freeware or something else?
"libcrypto" is not a part of OS but is locally built under
"/usr/local/openssl".
The information above looks reasonable, because the issue was first discovered
upon moving out from OpenSSL 1.0.1 over to 1.1.1 (I can accept that some
changes were introduced with ver. 1.1.1).
Another thing found is that, OpenSSH 9.1p "configure" failed anyway
with the same "libcrypto" error even if using "-lpthread",
thus producing another set of errors but this time related to "zlib":
<...>
configure:15328: cc -qlanglvl=extc99 -o conftest -g -q64
-I/usr/local/openssl/include -I/usr/local/zlib/include -L/usr/local/openssl/lib
-L/usr/local/zlib/lib -q64 conftest.c -lcrypto -lpthread >&5
ld: 0711-317 ERROR: Undefined symbol: .deflate
ld: 0711-317 ERROR: Undefined symbol: .zError
ld: 0711-317 ERROR: Undefined symbol: .deflateInit_
ld: 0711-317 ERROR: Undefined symbol: .inflate
ld: 0711-317 ERROR: Undefined symbol: .inflateInit_
ld: 0711-317 ERROR: Undefined symbol: .inflateEnd
ld: 0711-317 ERROR: Undefined symbol: .deflateEnd
So, now "configure" requires
--with-libs='-lpthread -lz'
To finish successfully.
For testing purposes, two sources ver. 8.9p1 and 9.1p1 were configured in the
same environment one-by-one in a matter of few minutes.
Ver. 8.9p1 finished successfully while ver. 9.1p1 produced the errors above
unless "-lz" option is added - this is a strong evidence (am I wrong?)
that, something has changes starting OpenSSH ver. 9.X.
--
Val Baranov (val.baranov at duke.edu