freeipa

#7110 Missing requirement in freeipa 4.5.90.dev201708161122+git799551892-0
Closed: fixed Opened by twoerner.

Closed: fixed
Reopen Issue

Using ipa-client-install with version 4.5.90.dev201708161122+git799551892-0 results in this error:

Configured /etc/krb5.conf for IPA realm MINE.DOM
sk_num: "function 'sk_num' not found in library 'libcrypto.so.1.1': /lib64/libcrypto.so.1.1: undefined symbol: sk_num"
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

After installing compat-openssl10 (and calling ldconfig) it is working. The manual ldconfig call is needed because of a missing ldconfig call in post install of compat-openssl10 (https://bugzilla.redhat.com/show_bug.cgi?id=1483011)

The code in FreeIPA's csr generator loads sk_num via FFI but openssl did change sk_num to be OPENSSL_sk_num in 1.1.0 series.

$ rpm -qf /usr/include/openssl/stack.h
openssl-devel-1.1.0f-7.fc26.x86_64
$ fgrep -r sk_num /usr/include/openssl/stack.h 
int OPENSSL_sk_num(const OPENSSL_STACK *);
#  define sk_num OPENSSL_sk_num

So the change would be to prepend our symbol usage with OPENSSL_.

Not so simple, actually!

I was playing with this for a while today and had some fun WTF moments because of ldconfig caching (ctypes.util.find_library() uses ldconfig internally to resolve the library you require).

If we just add the OPENSSL_ prefix to the certain spots, it will break machines that have compat-openssl installed. If we don't add it, however, we break the machines that don't have it installed (typically the "Cloud" Fedora machines).

I've fixed this by catching an exception and re-trying without OPENSSL_ prefix. Should work because accessing symbols from dynamically loaded libraries in FFI is like accessing attributes. If a symbol doesn't exist, AttributeError is generated.

See https://github.com/abbra/freeipa/pull/2/commits/40d09fafe9ef42efa70ec933782007a9d4650296 for details.

A good fix, let's get it upstream.

Metadata Update from @pvoborni:
- Issue priority set to: blocker
- Issue set to the milestone: FreeIPA 4.6

I submitted https://github.com/freeipa/freeipa/pull/1012

master:

  • 79378c90512a1cdd5f3d5ec6482e434caea06e01 csrgen: support openssl 1.0 and 1.1

Metadata Update from @tkrizek:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

This also has to be fixed in 4.5.

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.5.4 (was: FreeIPA 4.6)
- Issue status updated to: Open (was: Closed)

Actually, csrgen_ffi.py is not in 4.5. It was introduced in e7588ab2dc73e7f66ebc6cdcfb99470540e37731 which is only in master (4.6).

Metadata Update from @tkrizek:
- Issue close_status updated to: fixed
- Issue set to the milestone: FreeIPA 4.6 (was: FreeIPA 4.5.4)
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.