GnuTLS build fails on Ubuntu

[sebsto]

When trying to build gnutls on Ubuntu, I am receiving the following error after the test phase.

cipher-openssl-compat.o: In function `cipher_test':
/home/ubuntu/gnutls/Build-Scripts/gnutls-3.6.6/tests/slow/cipher-openssl-compat.c:42: undefined reference to `EVP_get_cipherbyname'
/home/ubuntu/gnutls/Build-Scripts/gnutls-3.6.6/tests/slow/cipher-openssl-compat.c:104: undefined reference to `EVP_CIPHER_CTX_new'
/home/ubuntu/gnutls/Build-Scripts/gnutls-3.6.6/tests/slow/cipher-openssl-compat.c:146: undefined reference to `EVP_CipherInit_ex'
/home/ubuntu/gnutls/Build-Scripts/gnutls-3.6.6/tests/slow/cipher-openssl-compat.c:149: undefined reference to `EVP_CIPHER_CTX_ctrl'
/home/ubuntu/gnutls/Build-Scripts/gnutls-3.6.6/tests/slow/cipher-openssl-compat.c:155: undefined reference to `EVP_CipherUpdate'
/home/ubuntu/gnutls/Build-Scripts/gnutls-3.6.6/tests/slow/cipher-openssl-compat.c:160: undefined reference to `EVP_CipherUpdate'
/home/ubuntu/gnutls/Build-Scripts/gnutls-3.6.6/tests/slow/cipher-openssl-compat.c:166: undefined reference to `EVP_CipherFinal_ex'
/home/ubuntu/gnutls/Build-Scripts/gnutls-3.6.6/tests/slow/cipher-openssl-compat.c:175: undefined reference to `EVP_CIPHER_CTX_free'
cipher-openssl-compat.o: In function `doit':
/home/ubuntu/gnutls/Build-Scripts/gnutls-3.6.6/tests/slow/cipher-openssl-compat.c:194: undefined reference to `OPENSSL_add_all_algorithms_noconf'
collect2: error: ld returned 1 exit status
Makefile:1766: recipe for target 'cipher-openssl-compat' failed

[noloader]

I can't duplicate this on Debian 8. I don't have a Ubuntu machine.

Can you troubleshoot it and provide a patch?

[llqll]

I have the same problem.have you solved?can you give me help?

[sebsto]

I did not progress on this.

[sebsto]

I tested today with latest pull and GNUTls 3.6.7 and still experiencing the same issue.
According to https://wiki.gentoo.org/wiki/Project:Quality_Assurance/As-needed#Failure_in_final_linking.2C_undefined_symbols, it looks like the problem is due to the order of the libraries being linked in this command

 /bin/bash ../../libtool  --tag=CC   --mode=link gcc -fno-common -W -Waddress -Waggressive-loop-optimizations -Wall -Wattributes -Wbad-function-cast -Wbool-compare -Wbool-operation -Wbuiltin-declaration-mismatch -Wbuiltin-macro-redefined -Wcast-align -Wchar-subscripts -Wclobbered -Wcomment -Wcomments -Wcoverage-mismatch -Wcpp -Wdangling-else -Wdate-time -Wdeprecated -Wdeprecated-declarations -Wdesignated-init -Wdisabled-optimization -Wdiscarded-array-qualifiers -Wdiscarded-qualifiers -Wdiv-by-zero -Wdouble-promotion -Wduplicated-branches -Wduplicated-cond -Wduplicate-decl-specifier -Wempty-body -Wendif-labels -Wenum-compare -Wexpansion-to-defined -Wextra -Wformat-contains-nul -Wformat-extra-args -Wformat-security -Wformat-zero-length -Wframe-address -Wfree-nonheap-object -Whsa -Wignored-attributes -Wignored-qualifiers -Wimplicit -Wimplicit-function-declaration -Wimplicit-int -Wincompatible-pointer-types -Winit-self -Wint-conversion -Wint-in-bool-context -Wint-to-pointer-cast -Winvalid-memory-model -Winvalid-pch -Wlogical-not-parentheses -Wlogical-op -Wmain -Wmaybe-uninitialized -Wmemset-elt-size -Wmemset-transposed-args -Wmisleading-indentation -Wmissing-braces -Wmissing-declarations -Wmissing-field-initializers -Wmissing-include-dirs -Wmissing-parameter-type -Wmissing-prototypes -Wmultichar -Wnarrowing -Wnested-externs -Wnonnull -Wnonnull-compare -Wnull-dereference -Wodr -Wold-style-declaration -Wold-style-definition -Wopenmp-simd -Woverflow -Woverride-init -Wpacked -Wpacked-bitfield-compat -Wparentheses -Wpointer-arith -Wpointer-compare -Wpointer-sign -Wpointer-to-int-cast -Wpragmas -Wpsabi -Wrestrict -Wreturn-local-addr -Wreturn-type -Wscalar-storage-order -Wsequence-point -Wshadow -Wshift-count-negative -Wshift-count-overflow -Wshift-negative-value -Wsizeof-array-argument -Wsizeof-pointer-memaccess -Wstrict-aliasing -Wstrict-prototypes -Wsuggest-attribute=format -Wsuggest-final-methods -Wsuggest-final-types -Wswitch -Wswitch-bool -Wswitch-unreachable -Wsync-nand -Wtautological-compare -Wtrampolines -Wtrigraphs -Wtype-limits -Wuninitialized -Wunknown-pragmas -Wunused -Wunused-but-set-parameter -Wunused-but-set-variable -Wunused-function -Wunused-label -Wunused-local-typedefs -Wunused-macros -Wunused-parameter -Wunused-result -Wunused-value -Wunused-variable -Wvarargs -Wvariadic-macros -Wvector-operation-performance -Wvolatile-register-var -Wwrite-strings -Walloc-size-larger-than=9223372036854775807 -Warray-bounds=2 -Wformat-overflow=2 -Wformat-truncation=2 -Wimplicit-fallthrough=5 -Wnormalized=nfc -Wshift-overflow=2 -Wstringop-overflow=2 -Wunused-const-variable=2 -Wvla-larger-than=4031 -Wno-missing-field-initializers -Wno-unused-parameter -Wno-format-truncation -Wimplicit-fallthrough=2 -Wabi=11 -fdiagnostics-show-option  -g2 -O2 -march=native -fPIC ../libutils.la ../../gl/libgnu.la ../../lib/libgnutls.la  /home/ubuntu/gnutls/lib/libcrypto.so -Wl,-rpath -Wl,/home/ubuntu/gnutls/lib -L/home/ubuntu/gnutls/lib -Wl,-R,/home/ubuntu/gnutls/lib -Wl,--enable-new-dtags -o cipher-openssl-compat cipher-openssl-compat.o ../libutils.la ../../gl/libgnu.la ../../lib/libgnutls.la

[noloader]

Sent to gnutls-devel mailing list.

On Sun, Apr 21, 2019 at 11:45 AM Jeffrey Walton <noloader@gmail.com> wrote:
>
> Hi Everyone,
>
> I'm building GnuTLS 3.6.7.1 from sources. I'm working on this issue:
> https://github.com/noloader/Build-Scripts/issues/7 . It is a link
> issue in 'make check'. I am able to duplicate the issue on Ubuntu
> Bionic. Fedora is OK.
>
> From the looks of it, libcrypto.so appears too early in the list of
> link libraries. I believe /usr/local/lib/libcrypto.so should be
> present after cipher-openssl-compat.o (and not before).
>
> Jeff
>
> -----
>
> libtool: link: gcc -fno-common -W -Waddress
> -Waggressive-loop-optimizations -Wall -Wattributes -Wbad-function-cast
> -Wbool-compare -Wbool-operation -Wbuiltin-declaration-mismatch
> -Wbuiltin-macro-redefined -Wcast-align -Wchar-subscripts -Wclobbered
> -Wcomment -Wcomments -Wcoverage-mismatch -Wcpp -Wdangling-else
> -Wdate-time -Wdeprecated -Wdeprecated-declarations -Wdesignated-init
> -Wdisabled-optimization -Wdiscarded-array-qualifiers
> -Wdiscarded-qualifiers -Wdiv-by-zero -Wdouble-promotion
> -Wduplicated-branches -Wduplicated-cond -Wduplicate-decl-specifier
> -Wempty-body -Wendif-labels -Wenum-compare -Wexpansion-to-defined
> -Wextra -Wformat-contains-nul -Wformat-extra-args -Wformat-security
> -Wformat-zero-length -Wframe-address -Wfree-nonheap-object -Whsa
> -Wignored-attributes -Wignored-qualifiers -Wimplicit
> -Wimplicit-function-declaration -Wimplicit-int
> -Wincompatible-pointer-types -Winit-self -Wint-conversion
> -Wint-in-bool-context -Wint-to-pointer-cast -Winvalid-memory-model
> -Winvalid-pch -Wlogical-not-parentheses -Wlogical-op -Wmain
> -Wmaybe-uninitialized -Wmemset-elt-size -Wmemset-transposed-args
> -Wmisleading-indentation -Wmissing-braces -Wmissing-declarations
> -Wmissing-field-initializers -Wmissing-include-dirs
> -Wmissing-parameter-type -Wmissing-prototypes -Wmultichar -Wnarrowing
> -Wnested-externs -Wnonnull -Wnonnull-compare -Wnull-dereference -Wodr
> -Wold-style-declaration -Wold-style-definition -Wopenmp-simd
> -Woverflow -Woverride-init -Wpacked -Wpacked-bitfield-compat
> -Wparentheses -Wpointer-arith -Wpointer-compare -Wpointer-sign
> -Wpointer-to-int-cast -Wpragmas -Wpsabi -Wrestrict -Wreturn-local-addr
> -Wreturn-type -Wscalar-storage-order -Wsequence-point -Wshadow
> -Wshift-count-negative -Wshift-count-overflow -Wshift-negative-value
> -Wsizeof-array-argument -Wsizeof-pointer-memaccess -Wstrict-aliasing
> -Wstrict-prototypes -Wsuggest-attribute=format -Wsuggest-final-methods
> -Wsuggest-final-types -Wswitch -Wswitch-bool -Wswitch-unreachable
> -Wsync-nand -Wtautological-compare -Wtrampolines -Wtrigraphs
> -Wtype-limits -Wuninitialized -Wunknown-pragmas -Wunused
> -Wunused-but-set-parameter -Wunused-but-set-variable -Wunused-function
> -Wunused-label -Wunused-local-typedefs -Wunused-macros
> -Wunused-parameter -Wunused-result -Wunused-value -Wunused-variable
> -Wvarargs -Wvariadic-macros -Wvector-operation-performance
> -Wvolatile-register-var -Wwrite-strings
> -Walloc-size-larger-than=9223372036854775807 -Warray-bounds=2
> -Wformat-overflow=2 -Wformat-truncation=2 -Wimplicit-fallthrough=5
> -Wnormalized=nfc -Wshift-overflow=2 -Wstringop-overflow=2
> -Wunused-const-variable=2 -Wvla-larger-than=4031
> -Wno-missing-field-initializers -Wno-unused-parameter
> -Wno-format-truncation -Wimplicit-fallthrough=2 -Wabi=11
> -fdiagnostics-show-option -g2 -O2 -march=native -fPIC
> /usr/local/lib/libcrypto.so -Wl,-rpath -Wl,/usr/local/lib -Wl,-R
> -Wl,/usr/local/lib -Wl,--enable-new-dtags -o
> .libs/cipher-openssl-compat cipher-openssl-compat.o  -L/usr/local/lib
> -L/usr/local/lib/../lib ../.libs/libutils.a
> /home/build/gnutls-3.6.7/lib/.libs/libgnutls.so
> /usr/local/lib/libp11-kit.so /usr/local/lib/../lib/libffi.so
> /usr/local/lib/libunistring.so /usr/local/lib/libiconv.so
> /usr/local/lib/libtasn1.so -lnettle -lhogweed /usr/local/lib/libgmp.so
> -ldl -lpthread ../../gl/.libs/libgnu.a ../../lib/.libs/libgnutls.so
> -Wl,-rpath -Wl,/usr/local/lib/../lib
> cipher-openssl-compat.o: In function `cipher_test':
> /home/build/gnutls-3.6.7/tests/slow/cipher-openssl-compat.c:42:
> undefined reference to `EVP_get_cipherbyname'
> /home/build/gnutls-3.6.7/tests/slow/cipher-openssl-compat.c:104:
> undefined reference to `EVP_CIPHER_CTX_new'
> /home/build/gnutls-3.6.7/tests/slow/cipher-openssl-compat.c:146:
> undefined reference to `EVP_CipherInit_ex'
> /home/build/gnutls-3.6.7/tests/slow/cipher-openssl-compat.c:149:
> undefined reference to `EVP_CIPHER_CTX_ctrl'
> /home/build/gnutls-3.6.7/tests/slow/cipher-openssl-compat.c:155:
> undefined reference to `EVP_CipherUpdate'
> /home/build/gnutls-3.6.7/tests/slow/cipher-openssl-compat.c:160:
> undefined reference to `EVP_CipherUpdate'
> /home/build/gnutls-3.6.7/tests/slow/cipher-openssl-compat.c:166:
> undefined reference to `EVP_CipherFinal_ex'
> /home/build/gnutls-3.6.7/tests/slow/cipher-openssl-compat.c:175:
> undefined reference to `EVP_CIPHER_CTX_free'
> cipher-openssl-compat.o: In function `doit':
> /home/build/gnutls-3.6.7/tests/slow/cipher-openssl-compat.c:194:
> undefined reference to `OPENSSL_add_all_algorithms_noconf'
> collect2: error: ld returned 1 exit status
> Makefile:1751: recipe for target 'cipher-openssl-compat' failed
> make[3]: *** [cipher-openssl-compat] Error 1
> make[3]: Leaving directory '/home/build/gnutls-3.6.7/tests/slow'
> Makefile:2172: recipe for target 'check-am' failed
> make[2]: *** [check-am] Error 2
> make[2]: Leaving directory '/home/build/gnutls-3.6.7/tests/slow'
> Makefile:7441: recipe for target 'check-recursive' failed
> make[1]: *** [check-recursive] Error 1
> make[1]: Leaving directory '/home/build/gnutls-3.6.7/tests'
> Makefile:1562: recipe for target 'check-recursive' failed
> make: *** [check-recursive] Error 1

[noloader]

Man, fixing GnuTLS is turning into a career... It looks like building against Guile is broken, and Ubuntu has a broken link. Autoconf sucks...

This commit fixes the broken link on Ubuntu: Commit add3e85aad77

I think some of the problems are related to these options that are used:

• --disable-openssl-compatibility
• --disable-ssl2-support
• --disable-ssl3-support

I'm not sure why test-ciphers-openssl.sh is being run because we use --disable-openssl-compatibility.

I don't know why test-ciphers-api.sh is failing at 3des-cbc. It may have something to do with --disable-ssl2-support and --disable-ssl3-support.

[sebsto]

Thank you for your effort and support. I tried with the latest version today and the cipher-openssl-compat test is now passing.

Next failure is on test-cipher-api as you mentioned above.

FAIL: test-ciphers-api.sh

There is very few information available in the log :-(

trying 3des-cbc
check_status:206: Child died with signal 11
default cipher tests failed
FAIL test-ciphers-api.sh (exit status: 1)

[noloader]

Yeah, I don't know what's wrong with the last test. A segfault is not very helpful.

I get the 3des-cbc error sometimes. I also get this error sometimes:

FAIL: test-ciphers-api.sh
=========================

trying aes128-gcm
test_aead_cipher1:142: succeeded in adding auth data data after partial data were given
check_status:209: Child died with status 1
default cipher tests failed
FAIL test-ciphers-api.sh (exit status: 1)

I've been thinking about deleting both test-ciphers-openssl.sh and test-ciphers-api.sh jobs since they don't seem reliable or robust. Tests that fail everywhere all the time are just noise.

---

Oh, and by the way... At this point - when the typical failures occur - I normally just install manually:

Build-Scripts$ cd gnutls-3.6.7/
Build-Scripts/gnutls-3.6.7$ sudo make install

[noloader]

I opened an issue with GnuTLS: OpenSSL backend and failures in cipher-api-test.c.