[prev in list] [next in list] [prev in thread] [next in thread] 

List:       debian-devel
Subject:    Re: OpenSSL 1.1.0
From:       Stepan Golosunov <stepan () golosunov ! pp ! ru>
Date:       2016-11-24 21:56:19
Message-ID: 20161124215619.GA23104 () sghpc ! golosunov ! pp ! ru
[Download RAW message or body]

24.11.2016 Χ 00:37:01 +0100 Kurt Roeckx ΞΑΠΙΣΑΜ:
> I've always had the impression that there are or used to be
> probems using using dlopen()/dlsym(). Maybe related to some things
> like RTDL_GLOBAL that causes the symbol lookup to go to the wrong
> library. Do you know of any problems related to that?

Some applications (asterisk) use dlsym without dlopen (with
RTLD_NEXT).  This definitely asks for trouble if there are more than
one libssl loaded.  (All of the functions dlsym'ed by Asterisk were
removed from libssl1.1 though.)

> Note that QT is one of those that uses dlopen()/dlsym() when
> calling openssl functions (for license reasons).

At least RTLD_GLOBAL (ExportExternalSymbolsHint) seems to be in
#ifdef Q_OS_OPENBSD
in qsslsocket_openssl_symbols.cpp.

qsslsocket_openssl_symbols.cpp also tries to load any libssl.* it can
find (in directories gathered from dl_iterate_phdr) when it cannot
find libssl.so.<SHLIB_VERSION_NUMBER>.  This asks for trouble when
libssl1.0.2 is not installed and probably needs to be patched out.
(Or openssl-linked should be used.  Or Breaks: libssl1.0.0, libssl1.1
looks necessary.)

[prev in list] [next in list] [prev in thread] [next in thread]