Compiling OpenSSL-1.1.1b on AIX

NevemTeve · 03-19-2019, 12:00 AM

Let's try in the practice what is written here: http://lzsiga.users.sourceforge.net/aix-linking.html

Source: https://www.openssl.org/source/openssl-1.1.1b.tar.gz

Assumptions:

* AIX5.3 or newer, 64-bit
* gcc installed
* libgcc_s.a or libgcc_s.so copied/linked in /usr/local/lib64
* libz is installed
* perl is installed
* bash is installed into /usr/local/bin
* sed_repl is installed into /usr/local/bin

Goal:
create these files, with hardcoded dependencies:

Code:

/usr/local/bin/openssl
/usr/local/lib64/libcrypto.so -> libcrypto.so.1.1.1.b
/usr/local/lib64/libcrypto.so.1.1 -> libcrypto.so.1.1.1.b
/usr/local/lib64/libcrypto.so.1.1.1.b
/usr/local/lib64/libssl.so -> libssl.so.1.1.1.b
/usr/local/lib64/libssl.so.1.1 -> libssl.so.1.1.1.b
/usr/local/lib64/libssl.so.1.1.1.b

Should it succeed, using application should be linked with options -Wl,-bipath /usr/local/lib64/libssl.so.1.1 /usr/local/lib64/libcrypt.so.1.1:

Code:

$ dump -H -X64 $(which wget)
                        ***Import File Strings***
INDEX  PATH                          BASE                MEMBER              
0      /usr/lib                                                              
1      /usr/local/lib64              libcrypto.so.1.1                        
...
7      /usr/local/lib64              libssl.so.1.1

NevemTeve · 03-19-2019, 05:37 AM

This scripts in not yet complete, but it is a start.

Code:

#!/usr/local/bin/bash

set -e
set -o pipefail

W1=1
W2=1
W3=1
W4=b

VTOTALF="$W1.$W2.$W3.$W4"       # Filename:        1.1.1.b
VTOTALC="$W1.$W2.$W3$W4"        # Compressed:      1.1.1b
VMAJOR="$W1.$W2"                # Major:           1.1
VMINOR="$W3.$W4"                # Minor:           1.b
VMINORC="$W3$W4"                # Compressed:      1b

export PATH=/usr/local/bin:/opt/freeware/bin:"$PATH"
export PKG_CONFIG_PATH=/usr/local/lib64/pkg-config"${PKG_CONFIG_PATH+:$PKG_CONFIG_PATH}"

cd "openssl-$VTOTALC"

make distclean || make clean || true

export CFLAGS='-maix64 -pthread'
export LDFLAGS='-maix64 -pthread -Wl,-bernotok,-brtl,-bnortllib,-blibpath:/usr/lib -L/usr/local/lib64'
export LDLIBS='-lz'

(./Configure \
 shared \
 zlib \
 no-zlib-dynamic \
 enable-ssl3 enable-ssl3-method \
 enable-weak-ssl-ciphers \
 --prefix=/usr/local \
 --libdir=lib64 \
 --openssldir=/usr/local/ssl \
 aix64-gcc &&

 perl configdata.pm --dump
) 2>&1 | tee >../log.configure

# for some reason '-blibpath:/usr/lib' became '-blibpath /usr/lib' in Makefile
# undo it
sed_repl 's/-blibpath /-blibpath:/' Makefile

# to link shared objects, option '-shared' seems to be better
sed_repl 's/DSO_LDFLAGS=-Wl,-G,-bsymbolic,-bexpall/DSO_LDFLAGS=-shared/' Makefile

make all 2>&1 | tee ../log.make.all

(
set -xv

gcc ${LDFLAGS} -shared -static-libgcc \
    -Wl,-bE:libcrypto.map \
    -o libcrypto.so."$VTOTALF" libcrypto_a.a ${LDLIBS}

ln -sf libcrypto.so."$VTOTALF" libcrypto.so."$VMAJOR"
ln -sf libcrypto.so."$VMAJOR"  libcrypto.so

gcc ${LDFLAGS} -shared -static-libgcc \
    -Wl,-bE:libssl.map \
    -o libssl.so."$VTOTALF" libssl_a.a libcrypto.so."$VMAJOR"

ln -sf libssl.so."$VTOTALF" libssl.so."$VMAJOR"
ln -sf libssl.so."$VMAJOR"  libssl.so

gcc ${LDFLAGS} -shared -static-libgcc \
    -o apps/openssl apps/*.o \
    libssl.so.$VMAJOR libcrypto.so.$VMAJOR ${LDLIBS}

for i in capi dasync ossltest padlock; do
    gcc ${LDFLAGS} -shared -static-libgcc \
        -o engines/$i.so.$VMAJOR engines/e_$i.o \
        libcrypto.so.$VMAJOR ${LDLIBS}
    ln -sf $i.so.$VMAJOR engines/$i.so
done

) &> ../log.localextra

Michael AM · 05-01-2019, 03:56 PM

Interesting - but please note that much of the specifics are from when using gcc (on AIX), because the gcc run-time environment is not "native" as it is on (GNU-)Linux systems.

I downloaded the same package and then ran the following to create Makefile

./Configure aix-cc --prefix=/opt/aixtools --openssldir=/var/ssl LDFLAGS=-R/opt/aixtools/lib

make install DESTDIR=/var/aixtools/aixtools/openssl/1.1.1.0 # For packaging

But from the build I run dump -H and get:

Code:

root@x066:[/data/prj/aixtools/openssl/openssl-1.1.1b]dump -H ./apps/openssl

./apps/openssl:

                        ***Loader Section***
                      Loader Header Information
VERSION#         #SYMtableENT     #RELOCent        LENidSTR
0x00000001       0x0000065f       0x00001cb4       0x00000090

#IMPfilID        OFFidSTR         LENstrTBL        OFFstrTBL
0x00000006       0x0001f178       0x000076c7       0x0001f208


                        ***Import File Strings***
INDEX  PATH                          BASE                MEMBER
0      /opt/aixtools/lib:/usr/lib:/lib
1                                    libssl.a            libssl.so.1.1
2                                    libcrypto.a         libcrypto.so.1.1
3                                    libpthreads.a       shr_xpg5.o
4                                    libc.a              shr.o
5                                    librtl.a            shr.o

ldd - before install fails, as expected...

Code:

root@x066:[/data/prj/aixtools/openssl/openssl-1.1.1b]ldd ./apps/openssl
./apps/openssl needs:
         /opt/aixtools/lib/libssl.a(libssl.so.1.1)
ar: 0707-109 Member name libssl.so.1.1 does not exist.
dump: /tmp/tmpdir7012416/extract/libssl.so.1.1: 0654-106 Cannot open the specified file.
         /opt/aixtools/lib/libcrypto.a(libcrypto.so.1.1)
ar: 0707-109 Member name libcrypto.so.1.1 does not exist.
dump: /tmp/tmpdir7012416/extract/libcrypto.so.1.1: 0654-106 Cannot open the specified file.
         /usr/lib/libpthreads.a(shr_xpg5.o)
         /usr/lib/libc.a(shr.o)
         /usr/lib/librtl.a(shr.o)
         /usr/lib/libpthreads.a(shr_comm.o)
         /unix
         /usr/lib/libcrypt.a(shr.o)

After install:

Code:

root@x066:[/data/prj/aixtools/openssl/openssl-1.1.1b]ldd ./apps/openssl
./apps/openssl needs:
         /opt/aixtools/lib/libssl.a(libssl.so.1.1)
         /opt/aixtools/lib/libcrypto.a(libcrypto.so.1.1)
         /usr/lib/libpthreads.a(shr_xpg5.o)
         /usr/lib/libc.a(shr.o)
         /usr/lib/librtl.a(shr.o)
         /usr/lib/libpthreads.a(shr_comm.o)
         /unix
         /usr/lib/libcrypt.a(shr.o)

and

Code:

root@x066:[/data/prj/aixtools/openssl/openssl-1.1.1b]ldd /opt/aixtools/bin/openssl
/opt/aixtools/bin/openssl needs:
         /opt/aixtools/lib/libssl.a(libssl.so.1.1)
         /opt/aixtools/lib/libcrypto.a(libcrypto.so.1.1)
         /usr/lib/libpthreads.a(shr_xpg5.o)
         /usr/lib/libc.a(shr.o)
         /usr/lib/librtl.a(shr.o)
         /usr/lib/libpthreads.a(shr_comm.o)
         /unix
         /usr/lib/libcrypt.a(shr.o)

So, my experience with packaging is that it is much much simpler when working with xlc.

Hope this is interesting, aka helps.

p.s. If you are interested my my scripts for packaging using installp, rather than rpm please look at http://www.aixtools.net/index.php/buildaix

The scrtipts are "Far from perfect" - feel free to tell me how they can be improved and I'll get my git project updated - and we can collaborate!

NevemTeve · 05-03-2019, 07:39 AM

Hi, thank you for your answer; my problem is not with xlc, it is the 'shared object in .a archive' concept.

If you have wget/curl/lynx/openssh that depend on /opt/aixtool/lib/libcrypto.a(libcrypto.so.1.0) then you build openssl-1.1.1x, these programs won't work until you rebuild them.
With standalone shared objects it it something like this:

Code:

/usr/local/lib64/libcrypto.so -> libcrypto.so.1.1.1.b
/usr/local/lib64/libcrypto.so.1.0.1 -> libcrypto.so.1.0.1.o
/usr/local/lib64/libcrypto.so.1.0.1.o
/usr/local/lib64/libcrypto.so.1.0.2 -> libcrypto.so.1.0.2.p
/usr/local/lib64/libcrypto.so.1.0.2.p
/usr/local/lib64/libcrypto.so.1.1 -> libcrypto.so.1.1.1.b
/usr/local/lib64/libcrypto.so.1.1.1.b

In this case existing programs keep working, if they depend on libcrypto.so.1.0.1 or libcrypto.so.1.0.2