Forum OpenACS Q&A: nsopenssl build problem

Posted by Eric Lee on 09/16/02 06:32 AM

gmake OPENSSL=/opt/usr/local

is OK through:
...
/bin/rm -f nsopenssl.so
gcc -shared -nostartfiles -o nsopenssl.so nsopenssl.o config.o init.o 
ssl.o thread.o tclcmds.o -L/opt/usr/local/lib -lssl -lcrypto -
L/usr/local/lib/gcc-lib/i386-pc-solaris2.7/2.95.2 -lgcc
Text relocation remains                         referenced
    against symbol                  offset      in file
des_SPtrans 0x305       /opt/usr/local/lib/libcrypto.a(dx86-sol.o)
...
until
...
   0x22d8      /opt/usr/local/lib/libcrypto.a(dx86-sol.o)
ld: fatal: relocations remain against allocatable but non-writable 
sections
collect2: ld returned 1 exit status
gmake: *** [nsopenssl.so] Error 1

Can anyone suggest where to look for the problem?

Same error whether run as root or nsadmin
 
Environment: 
Solaris 2.7 x86 
OpenSSL 0.9.6g 
nsopenssl 2.1 
AOLserver 3.4.2 

This is part of an upgrade from AOLserver 2.3.3 to 3.4.2. 
Therefore /opt/usr/local/aolserver is already in use. I'm installing 
to /opt/usr/local/aolserver3. I think I've made the necessary changes 
in the nsopenssl Makefile and aolserver3/include/Makefile.global

Thanks much, 

Eric Lee

2: Response to nsopenssl build problem (response to 1)

Posted by Andrew Piskorski on 09/16/02 05:35 PM

Eric, did you modify nsopenssl/Makefile for Solaris as mentioned in the nsopenssl docs? Here's a snippet of what I have:

# NOTE!!! Solaris need the following, but you'll need to modify it to 
# point to where your libgcc.a sits: 

#MODLIBS  =  -L$(OPENSSL)/lib -lssl -lcrypto -L/usr/local/products/gcc-2.95/lib/gcc-lib/sparc-sun-solaris2.5.1/2.95 -lgcc 

# Then this should be correct for us:  --atp@piskorski.com, 2001/07/25 19:22 EDT 
MODLIBS  =  -Bstatic -L$(OPENSSL)/lib -lssl -lcrypto -L /opt/sfw/lib/gcc-lib/sparc-sun-solaris2.8/2.95.2/ -lgcc

3: Response to nsopenssl build problem (response to 1)

Posted by Eric Lee on 09/16/02 06:59 PM

1. Yes, I made that change, which I believe is shown in the output from the successful part of the build (below) but the error is the
same with or without that addition. 
I also tried adding
CFLAGS   +=  -I$(OPENSSL)/include/openssl
to the Makefile per the OpenSSL INSTALL advice: Again, same results
with or without it.

gcc -shared -nostartfiles -o nsopenssl.so nsopenssl.o config.o init.o 
ssl.o thread.o tclcmds.o -L/opt/usr/local/lib -lssl -lcrypto
-L/usr/local/lib/gcc-lib/i386-pc-solaris2.7/2.95.2 -lgcc

2. Before it dies the build seems to have created all of the OBS (*.o) but not the MOD (nsopenssl.so) and not so_locations.

3. What I think I need is some help understanding what ld is doing or what it needs in this step. 
What are the "sections" it is referring to as non-writable in the error message?

Text relocation remains                         referenced
    against symbol                  offset      in file
des_SPtrans 0x305       /opt/usr/local/lib/libcrypto.a(dx86-sol.o)
...
until
...
   0x22d8      /opt/usr/local/lib/libcrypto.a(dx86-sol.o)
ld: fatal: relocations remain against allocatable but non-writable 
sections
collect2: ld returned 1 exit status
gmake: *** [nsopenssl.so] Error 1

4: Response to nsopenssl build problem (response to 1)

Posted by Andrew Piskorski on 09/17/02 10:26 PM

Hm. I'm not really clear on what the linker is doing there either, but here are some random things I ran into before that might be of some use:

For some reason I didn't recall, in my aolserver/include/Makefile.global I changed the ld used on Solaris like so:

<     LD=/usr/ccs/bin/ld 
--- 
>     #LD=/usr/ccs/bin/ld 
>     LD=/usr/ccs/bin/ld -L/etc/lib -ldl

I don't know if it makes a difference whether you use the Sun or Gnu ld. By default I believe the AOLserver makefiles use just plain ld, which is the Sun ld on Solaris, and that's what I'm using.

Back in April I had problems with ld deciding to link against what I believe is/was a buggy libssl.so, so I added that -Bstatic incantation above to make it link against libssl.a instead:

date: 2002/04/09 01:34:38; author: andy; state: Exp; lines: +2 -2 New version of OpenSSL was giving weird 'ld.so.1: /web/aol3/bin/nsd: fatal: relocation error: file /web/aol3/bin/nsopenssl.so: symbol SSL_CTX_free: referenced symbol not found' errors, and grep showed that SSL_CTX_free symbol was present in libssl.a but NOT in libssl.so. So, added -Bstatic to link against libssl.a - thanks to Scott Blomquist <sb@techsquare.com> who came up with this solution.

But none of those sound quite like your problem. If no one else chimes in, I'd contact Scott Goodwin directly, as he's generally very helpful.

5: Response to nsopenssl build problem (response to 1)

Posted by Drazen Kacar on 09/20/02 03:17 PM

ld: fatal: relocations remain against allocatable but non-writable sections

means that you have not compiled your code with PIC flag. The linker doesn't throw that error by default, but gcc asks for it behind your back. So recompile with -fPIC.

The sections in question are ELF sections. Allocatable means that they will be placed into the object you are building (your shared library) and non-writable means read-only, ie. the text segment. That's the part with the code. It's supposed to be shared among all processes which use that library, but it cannot be shared unless the code was compiled with PIC flag.

So the compiler is trying to do you a favor by asking linker to throw an error if you forget to specify PIC flag when compiling.

I have no idea why AOLserver Makefiles want to build modules directly with ld or with gcc's -nostartfiles option. As far as I can tell, that's a bug.

6: Response to nsopenssl build problem (response to 1)

Posted by Eric Lee on 10/01/02 12:37 AM

Andrew's Sept. 17 suggestion did the trick. I modified the SunOS/ Solaris branch of aolserver/include/Makefile.global as shown in bold below. I'd still like to know what this actually does.

ifneq (,$(findstring SunOS,$(PLAT)))
    PLATFORM=solaris

    ifdef nativeme
        # This nativeme branch fails on badger:
        #  /usr/ucb/cc:  language optional software package not installed
        CC=$(PURIFY) /usr/ucb/cc
        # no /opt/SUNWspro/bin/cc on badger
        #CC=$(PURIFY) /opt/SUNWspro/bin/cc
        #CCOPTIMIZE = -x02
        CCOPTIMIZE = -g
        CFLAGS+=$(CCOPTIMIZE) -KPIC -erroff=%none
        LD=/usr/ccs/bin/ld
        # Piskorski version:
        #LD=/usr/ccs/bin/ld -L/etc/lib -ldl
        LDSO=$(LD) -G
        ifneq (,$(findstring sparc,$(PLAT)))
            CFLAGS+=-xarch=v8plusa
        else
            CFLAGS+=-xpentium
        endif
    else
        ifneq (,$(findstring sparc,$(PLAT)))
            CFLAGS+=$(GCCOPT) -mcpu=ultrasparc
        else
            # This is the branch actually taken.
            CFLAGS+=$(GCCOPT) -mcpu=pentium
            #
            # 19Sep02 EL Per A.Piskorski.
            LD=/usr/ccs/bin/ld -L/etc/lib -ldl
            LDSO=$(LD) -G
        endif
    endif


    NSDLIBS=-lm
    LIBS+=-lsocket -lnsl -ldl -lposix4 -lthread -lresolv -R $(RPATH)
    AR=/usr/ccs/bin/ar
    CFLAGS+=-D_POSIX_PTHREAD_SEMANTICS=1 -DUSE_PTHREAD_SYSSCOPE=1 
            -DUSE_PTHREAD_PSHARED=1 -DHAVE_ETIME_BUG=1 
            -DUSE_DUPHIGH=1 -DHAVE_FORK1=1
endif

To respond to Drazen Kacar's suggestion, Makefile.global is set up to use -fPIC by default, although this was not indicated in the output from gcc

GCCOPT       =   $(GCCOPTIMIZE) -fPIC -Wall -Wno-unused

Another user suggested the problem might be using Sun's ld instead of GNU's (gld), but the the successful build was eventually done with Sun's ld, which had been used all along

Thanks very much to all to took the time to help.

Eric Lee

7: Response to nsopenssl build problem (response to 1)

Posted by Andrew Piskorski on 10/03/02 05:13 PM

Hm, well:

-Ldir: Add directory dir to the list of directories to be searched for `-l'.
-llibrary: Search the library named library when linking.

So, the linking problem we fixed here is that on Solaris we need to include the /etc/libdl.so library to give us the API for the runtime linker, and adding the above -L/etc/lib -ldl switches make that happen.