tcnative dynamic - UnsatisfiedLinkError: libssl.so.1.0.0

[grun077]

I'm running an echo server with netty, openssl and a pkcs11 engine. I built tcnative static and included it with

<dependency>
    <groupId>io.netty</groupId>
    <artifactId>netty-tcnative-openssl-static</artifactId>
    <version>${netty-tcnative.version}</version>
    <classifier>linux-x86_64</classifier>
</dependency>

When i executed a tls handshake with openssl s_client OpenSslKeyMaterialManager throws at line 111 engine.setKeyMaterial(keyMaterial) an openssl EC_POINT_cmp incompatible objects exception. The issue seems similar to

EC_POINT_cmp returns error when using a dynamic ENGINE and statically linked openssl

Therefore i would like to include tcnative dynamic.

<dependency>
    <groupId>io.netty</groupId>
    <artifactId>netty-tcnative</artifactId>
    <version>${netty-tcnative.version}</version>
    <classifier>linux-x86_64</classifier>
</dependency>

My naive approach using debian:buster-slim results in an exception due to incompatible openssl versions.

java.lang.UnsatisfiedLinkError: /tmp/libnetty_tcnative_linux_x86_648993204766238630779.so: libssl.so.1.0.0: cannot open shared object file: No such file or directory

I read the how to use / build section in tcnative wiki, i also checked related issues in github netty / tcnative and stackoverflow. Especially

Cannot use Openssl 1.1.1f with netty-tcnative, we get UnsatisfiedLinkError: .. libssl.so.1.0.0

I checked the tcnative source code and especially the docker files but i did not manage to do the required changes for openssl 1.1.1. If someone can give me a hint what needs to be changed, i would really appreciate it.

I also tried the other way around. Instead of trying to upgrade tcnative dynamic to 1.1.1 provide a Dockerfile which contains everything for a successful dynamically linking. I installed libssl 1.0.2 on debian:buster-slim (libssl.so.1.0.2), but i get the same exception. netty-tcnative seems to expect exactly libssl1.0.0.

echo 'deb http://ftp.de.debian.org/debian stretch main contrib non-free' >> /etc/apt/sources.list
apt-get update
apt-get -y install --no-install-recommends libssl1.0.2

I would at least require openssl 1.0.2 to have brainpool parameter support. Does someone perhaps have an example Dockerfile which successfully links with tcnative dynamic?

I someone can give me a hint I would really appreciate it. Thanks in advance.

[chrisvest]

There are two ways:

1. Make a symlink with the name that tcnative expects, that points to your openssl library. (You may need to do this for libcrypto as well)
2. Switch to the boringssl variant of tcnative. It includes a statically linked BoringSSL, which means your system-provided OpenSSL won't be needed or used.

[grun077]

Thank you, using symlinks I was able to get it run with tcnative dynamic. Only for curiosity I also tried a symlink to openssl 1.1.1 but that does not work. I got an exception that openssl version 1.0.0 is expected. The pkcs11 engine is configured by defining ENV OPENSSL_CONF=/etc/ssl/openssl.cnf with following content

openssl_conf = openssl_def

[openssl_def]
engines = engine_section

[engine_section]
pkcs11 = pkcs11_section

[pkcs11_section]
engine_id = pkcs11
dynamic_path = /usr/lib/x86_64-linux-gnu/openssl-1.0.2/engines/pkcs11.so
MODULE_PATH = /usr/lib/libcs_pkcs11.so
PIN = "123456"

In addition i have to start the echo server also with

-Dio.netty.handler.ssl.openssl.engine=pkcs11

Unfortunately this does not work, In Library.java the line

SSL.initialize(engine). 

throws

java.lang.Exception: This function has not been implemented on this platform

The dynamic path points to libengine-pkcs11-openssl=0.4.3-1 to be compatible to OpenSsl 1.0.2.

When I bash into the container and run

env OPENSSL_CONF=openssl.cnf PKCS11_CFG=pkcs11.cfg openssl s_server -tls1_2 -curves brainpoolP256r1 -cert cert.pem -key private-key.pem

I am not able to successfully do a tls handshake. I guess the pkcs11 module is implemented against OpenSsl 1.1.1 and therefor it does not work. If I run the above with 1.1.1 the s_server works without problems.

Perhaps i have to go back to tcnative static which I build against 1.1.1q. But there I have no idea how I can setup to pkcs11 engine like above, My impression was, that if -i configure an env variable OPENSSL_CONF this is not applied to the static openssl.

Sorry for getting off topic from loading tcntive dynamic.