@@ -38,6 +38,32 @@ static struct aws_allocator *s_libcrypto_allocator = NULL;
3838 * and avoid dead-stripping
3939 */
4040#if defined(OPENSSL_IS_AWSLC ) || defined(OPENSSL_IS_BORINGSSL )
41+ /* TODO:the weak refs is not GUARANTEED to avoid linker to strip the symbol.
42+ Build on musl with openssl 1.1.1w, those those was referenced, but still stripped from libcrypto during linking.
43+ Logs was:
44+ ```
45+ / # gcc -static -Wl,--trace-symbol=HMAC_CTX_new,-v -o test test.c -I $HOME/opt/aws/include -L $HOME/opt/aws/lib
46+ -laws-c-cal -laws-c-common /usr/lib/libcrypto.a -fno-lto collect2 version 11.2.1 20220219
47+ /usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1/../../../../x86_64-alpine-linux-musl/bin/ld --hash-style=gnu -m
48+ elf_x86_64 --as-needed -static -z now -o test /usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1/../../../../lib/crt1.o
49+ /usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1/../../../../lib/crti.o
50+ /usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1/crtbeginT.o -L/root/opt/aws/lib
51+ -L/usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1
52+ -L/usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1/../../../../x86_64-alpine-linux-musl/lib/../lib
53+ -L/usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1/../../../../lib -L/lib/../lib -L/usr/lib/../lib
54+ -L/usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1/../../../../x86_64-alpine-linux-musl/lib
55+ -L/usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1/../../.. --trace-symbol=HMAC_CTX_new -v /tmp/ccBcKMkh.o -laws-c-cal
56+ -laws-c-common /usr/lib/libcrypto.a -lssp_nonshared --start-group -lgcc -lgcc_eh -lc --end-group
57+ /usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1/crtend.o
58+ /usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1/../../../../lib/crtn.o
59+
60+ GNU ld (GNU Binutils) 2.38
61+ /usr/lib/gcc/x86_64-alpine-linux-musl/11.2.1/../../../../x86_64-alpine-linux-musl/bin/ld:
62+ /root/opt/aws/lib/libaws-c-cal.a(openssl_platform_init.c.o): reference to HMAC_CTX_new
63+ ```
64+ We don't really understand what strips the symbols, but aws-lc is a workaround.
65+ And, --require-defined=HMAC_CTX_new is another workaround to force the linker to keep the symbol.
66+ */
4167extern HMAC_CTX * HMAC_CTX_new (void ) __attribute__((weak , used ));
4268extern void HMAC_CTX_free (HMAC_CTX * ) __attribute__((weak , used ));
4369extern void HMAC_CTX_init (HMAC_CTX * ) __attribute__((weak , used ));
@@ -140,8 +166,12 @@ bool s_resolve_hmac_102(void *module) {
140166 /* were symbols bound by static linking? */
141167 bool has_102_symbols = init_fn && clean_up_fn && update_fn && final_fn && init_ex_fn ;
142168 if (has_102_symbols ) {
143- AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found static libcrypto 1.0.2 HMAC symbols" );
169+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found weak ref libcrypto 1.0.2 HMAC symbols" );
144170 } else {
171+ if (!module ) {
172+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "No loaded libcrypto 1.0.2 HMAC symbols found" );
173+ return false;
174+ }
145175 /* If symbols aren't already found, try to find the requested version */
146176 * (void * * )(& init_fn ) = dlsym (module , "HMAC_CTX_init" );
147177 * (void * * )(& clean_up_fn ) = dlsym (module , "HMAC_CTX_cleanup" );
@@ -180,8 +210,12 @@ bool s_resolve_hmac_111(void *module) {
180210 bool has_111_symbols = new_fn && free_fn && update_fn && final_fn && init_ex_fn ;
181211
182212 if (has_111_symbols ) {
183- AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found static libcrypto 1.1.1 HMAC symbols" );
213+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found weak ref libcrypto 1.1.1 HMAC symbols" );
184214 } else {
215+ if (!module ) {
216+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "No loaded libcrypto 1.1.1 HMAC symbols found" );
217+ return false;
218+ }
185219 * (void * * )(& new_fn ) = dlsym (module , "HMAC_CTX_new" );
186220 * (void * * )(& free_fn ) = dlsym (module , "HMAC_CTX_free" );
187221 * (void * * )(& update_fn ) = dlsym (module , "HMAC_Update" );
@@ -225,8 +259,12 @@ bool s_resolve_hmac_lc(void *module) {
225259 /* when built as a shared lib, and multiple versions of libcrypto are possibly
226260 * available (e.g. brazil), select AWS-LC by default for consistency */
227261 if (has_awslc_symbols ) {
228- AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found static aws-lc HMAC symbols" );
262+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found weak ref aws-lc HMAC symbols" );
229263 } else {
264+ if (!module ) {
265+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "No loaded aws-lc HMAC symbols found" );
266+ return false;
267+ }
230268 * (void * * )(& new_fn ) = dlsym (module , "HMAC_CTX_new" );
231269 * (void * * )(& free_fn ) = dlsym (module , "HMAC_CTX_free" );
232270 * (void * * )(& update_fn ) = dlsym (module , "HMAC_Update" );
@@ -266,8 +304,12 @@ bool s_resolve_hmac_boringssl(void *module) {
266304 bool has_bssl_symbols = new_fn && free_fn && update_fn && final_fn && init_ex_fn ;
267305
268306 if (has_bssl_symbols ) {
269- AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found static boringssl HMAC symbols" );
307+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found weak ref boringssl HMAC symbols" );
270308 } else {
309+ if (!module ) {
310+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "No loaded boringssl HMAC symbols found" );
311+ return false;
312+ }
271313 * (void * * )(& new_fn ) = dlsym (module , "HMAC_CTX_new" );
272314 * (void * * )(& free_fn ) = dlsym (module , "HMAC_CTX_free" );
273315 * (void * * )(& update_fn ) = dlsym (module , "HMAC_Update" );
@@ -352,8 +394,12 @@ bool s_resolve_md_102(void *module) {
352394 bool has_102_symbols = md_create_fn && md_destroy_fn && md_init_ex_fn && md_update_fn && md_final_ex_fn ;
353395
354396 if (has_102_symbols ) {
355- AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found static libcrypto 1.0.2 EVP_MD symbols" );
397+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found weak ref libcrypto 1.0.2 EVP_MD symbols" );
356398 } else {
399+ if (!module ) {
400+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "No loaded libcrypto 1.0.2 EVP_MD symbols found" );
401+ return false;
402+ }
357403 * (void * * )(& md_create_fn ) = dlsym (module , "EVP_MD_CTX_create" );
358404 * (void * * )(& md_destroy_fn ) = dlsym (module , "EVP_MD_CTX_destroy" );
359405 * (void * * )(& md_init_ex_fn ) = dlsym (module , "EVP_DigestInit_ex" );
@@ -387,8 +433,12 @@ bool s_resolve_md_111(void *module) {
387433
388434 bool has_111_symbols = md_new_fn && md_free_fn && md_init_ex_fn && md_update_fn && md_final_ex_fn ;
389435 if (has_111_symbols ) {
390- AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found static libcrypto 1.1.1 EVP_MD symbols" );
436+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found weak ref libcrypto 1.1.1 EVP_MD symbols" );
391437 } else {
438+ if (!module ) {
439+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "No loaded libcrypto 1.1.1 EVP_MD symbols found" );
440+ return false;
441+ }
392442 * (void * * )(& md_new_fn ) = dlsym (module , "EVP_MD_CTX_new" );
393443 * (void * * )(& md_free_fn ) = dlsym (module , "EVP_MD_CTX_free" );
394444 * (void * * )(& md_init_ex_fn ) = dlsym (module , "EVP_DigestInit_ex" );
@@ -426,8 +476,12 @@ bool s_resolve_md_lc(void *module) {
426476 md_new_fn && md_create_fn && md_free_fn && md_destroy_fn && md_init_ex_fn && md_update_fn && md_final_ex_fn ;
427477
428478 if (has_awslc_symbols ) {
429- AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found static aws-lc libcrypto 1.1.1 EVP_MD symbols" );
479+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "found weak ref aws-lc libcrypto 1.1.1 EVP_MD symbols" );
430480 } else {
481+ if (!module ) {
482+ AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "No loaded aws-lc libcrypto 1.1.1 EVP_MD symbols found" );
483+ return false;
484+ }
431485 * (void * * )(& md_new_fn ) = dlsym (module , "EVP_MD_CTX_new" );
432486 * (void * * )(& md_free_fn ) = dlsym (module , "EVP_MD_CTX_free" );
433487 * (void * * )(& md_init_ex_fn ) = dlsym (module , "EVP_DigestInit_ex" );
@@ -643,28 +697,25 @@ static void s_validate_libcrypto_linkage(void) {
643697static enum aws_libcrypto_version s_resolve_libcrypto (void ) {
644698 /* Try to auto-resolve against what's linked in/process space */
645699 AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "searching process and loaded modules" );
646- void * process = dlopen (NULL , RTLD_NOW );
647- AWS_FATAL_ASSERT (process && "Unable to load symbols from process space" );
648- enum aws_libcrypto_version result = s_resolve_libcrypto_symbols (AWS_LIBCRYPTO_LC , process );
700+ enum aws_libcrypto_version result = s_resolve_libcrypto_symbols (AWS_LIBCRYPTO_LC , NULL );
649701 if (result == AWS_LIBCRYPTO_NONE ) {
650702 AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "did not find aws-lc symbols linked" );
651- result = s_resolve_libcrypto_symbols (AWS_LIBCRYPTO_BORINGSSL , process );
703+ result = s_resolve_libcrypto_symbols (AWS_LIBCRYPTO_BORINGSSL , NULL );
652704 }
653705 if (result == AWS_LIBCRYPTO_NONE ) {
654706 AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "did not find boringssl symbols linked" );
655- result = s_resolve_libcrypto_symbols (AWS_LIBCRYPTO_1_1_1 , process );
707+ result = s_resolve_libcrypto_symbols (AWS_LIBCRYPTO_1_1_1 , NULL );
656708 }
657709 if (result == AWS_LIBCRYPTO_NONE ) {
658710 AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "did not find libcrypto 1.1.1 symbols linked" );
659- result = s_resolve_libcrypto_symbols (AWS_LIBCRYPTO_1_0_2 , process );
711+ result = s_resolve_libcrypto_symbols (AWS_LIBCRYPTO_1_0_2 , NULL );
660712 }
661- dlclose (process );
662713
663714 if (result == AWS_LIBCRYPTO_NONE ) {
664715 AWS_LOGF_DEBUG (AWS_LS_CAL_LIBCRYPTO_RESOLVE , "did not find libcrypto 1.0.2 symbols linked" );
665716 AWS_LOGF_DEBUG (
666717 AWS_LS_CAL_LIBCRYPTO_RESOLVE ,
667- "libcrypto symbols were not statically linked, searching for shared libraries" );
718+ "libcrypto symbols were not linked, searching for shared libraries and loading it " );
668719 result = s_resolve_libcrypto_sharedlib ();
669720 }
670721
0 commit comments