PKCS7_sign() method doesn't work in addon modules linking to openssl.

[Neilpang]

Ubuntu 14.04.

Using the latest Nodejs 0.10.29 compiled from source code, and the latest OpenSSL lib 1.0.1g

For short, the openssl demo code "smsign.c" doesn't work if compiled as an addon module.

The demo code smsign.c is here: https://github.com/joyent/node/blob/5fcd6e40385f45bc9091689337a7ab531861ba19/deps/openssl/openssl/demos/smime/smsign.c

The core error is "PKCS7_sign()" method failed without any error code or error message.

I just wrote a sample project, please clone it here: https://github.com/Neilpang/nodejstest

In the project, the "makefile" compiles the demo code as an executable, and it works successfully.

However, using the "bindings.gyp" it compiles the demo code as a nodejs addon, run the "sign.js" script, it shows the error.

Update, this issue doesn't happen on Mac, only in Ubuntu.

Windows has not been tested yet.

[indutny]

Sorry, the link seems to be broken? May be you could try storing your files as a gist?

[Neilpang]

Sorry,

I just checked it in here: https://github.com/Neilpang/nodejstest

thanks.

[indutny]

Whoa, so the answer is simple :) Remove libraries section from a binding.gyp. The node.js is statically compiled to the openssl that it is using, but when you are supplying -lcrypto and -lssl - you are using system's OpenSSL.

[Neilpang]

Nop.

I don't think openssl lib is statically linked in to Nodejs.

If I remove -lssl and -lcrypto from binding.gyp, there will be another runtime error: " undefined symbol: PKCS7_sign"

[Neilpang]

Could you please try the sample code ?

[indutny]

I just tried it and it works fine for me, I suppose you are building the module with node-gyp configure && node-gyp rebuild?

[indutny]

You may also consider adding this to your binding.gyp:

      "include_dirs": [
        "<(node_root_dir)/deps/openssl/openssl/include",
      ],

[Neilpang]

Yes, I removed -lssl and -lcrypto. but I just get this error when I run sign.js:

neil@neil-U:~/node/test$ node sign.js
node: symbol lookup error: /home/neil/node/test/build/Release/obj.target/sign.node: undefined symbol: PKCS7_sign

[Neilpang]

I removed all the "build" folder and built the module with:

node-gyp  configure  build

[indutny]

Could you please run it with: V=1 node-gyp configure rebuild and paste the results here?

[Neilpang]

Yes,

neil@neil-U:~/node/test$ V=1 node-gyp configure rebuild
gyp info it worked if it ends with ok
gyp info using node-gyp@0.13.1
gyp info using node@0.10.29 | linux | x64
gyp info spawn python
gyp info spawn args [ '/usr/local/lib/node_modules/node-gyp/gyp/gyp_main.py',
gyp info spawn args   'binding.gyp',
gyp info spawn args   '-f',
gyp info spawn args   'make',
gyp info spawn args   '-I',
gyp info spawn args   '/home/neil/node/test/build/config.gypi',
gyp info spawn args   '-I',
gyp info spawn args   '/usr/local/lib/node_modules/node-gyp/addon.gypi',
gyp info spawn args   '-I',
gyp info spawn args   '/home/neil/.node-gyp/0.10.29/common.gypi',
gyp info spawn args   '-Dlibrary=shared_library',
gyp info spawn args   '-Dvisibility=default',
gyp info spawn args   '-Dnode_root_dir=/home/neil/.node-gyp/0.10.29',
gyp info spawn args   '-Dmodule_root_dir=/home/neil/node/test',
gyp info spawn args   '--depth=.',
gyp info spawn args   '--no-parallel',
gyp info spawn args   '--generator-output',
gyp info spawn args   'build',
gyp info spawn args   '-Goutput_dir=.' ]
gyp info spawn python
gyp info spawn args [ '/usr/local/lib/node_modules/node-gyp/gyp/gyp_main.py',
gyp info spawn args   'binding.gyp',
gyp info spawn args   '-f',
gyp info spawn args   'make',
gyp info spawn args   '-I',
gyp info spawn args   '/home/neil/node/test/build/config.gypi',
gyp info spawn args   '-I',
gyp info spawn args   '/usr/local/lib/node_modules/node-gyp/addon.gypi',
gyp info spawn args   '-I',
gyp info spawn args   '/home/neil/.node-gyp/0.10.29/common.gypi',
gyp info spawn args   '-Dlibrary=shared_library',
gyp info spawn args   '-Dvisibility=default',
gyp info spawn args   '-Dnode_root_dir=/home/neil/.node-gyp/0.10.29',
gyp info spawn args   '-Dmodule_root_dir=/home/neil/node/test',
gyp info spawn args   '--depth=.',
gyp info spawn args   '--no-parallel',
gyp info spawn args   '--generator-output',
gyp info spawn args   'build',
gyp info spawn args   '-Goutput_dir=.' ]
gyp info spawn make
gyp info spawn args [ 'BUILDTYPE=Release', '-C', 'build' ]
make: Entering directory `/home/neil/node/test/build'
  g++ '-D_LARGEFILE_SOURCE' '-D_FILE_OFFSET_BITS=64' '-DBUILDING_NODE_EXTENSION' -I/home/neil/.node-gyp/0.10.29/src -I/home/neil/.node-gyp/0.10.29/deps/uv/include -I/home/neil/.node-gyp/0.10.29/deps/v8/include  -fPIC -Wall -Wextra -Wno-unused-parameter -pthread -m64 -O2 -fno-strict-aliasing -fno-tree-vrp -fno-omit-frame-pointer -fno-rtti -fno-exceptions -MMD -MF ./Release/.deps/Release/obj.target/sign/sign.o.d.raw  -c -o Release/obj.target/sign/sign.o ../sign.cc
In file included from ../sign.cc:8:0:
../head.h: In function ‘int test()’:
../head.h:32:17: warning: value computed is not used [-Wunused-value]
  BIO_reset(tbio);
                 ^
../head.h:60:16: warning: value computed is not used [-Wunused-value]
   BIO_reset(in);
                ^
  flock ./Release/linker.lock g++ -shared -pthread -rdynamic -m64  -Wl,-soname=sign.node -o Release/obj.target/sign.node -Wl,--start-group Release/obj.target/sign/sign.o -Wl,--end-group 
  SOLINK_MODULE(target) Release/obj.target/sign.node: Finished
  rm -rf "Release/sign.node" && cp -af "Release/obj.target/sign.node" "Release/sign.node"
make: Leaving directory `/home/neil/node/test/build'
gyp info ok 
neil@neil-U:~/node/test$ 

[indutny]

Oh, looks like the symbol slips away after linking openssl with node... I'll figure it out

[indutny]

Anyway, it appears to me to be a problem only on a OSX, can you confirm this?

[Neilpang]

Please tell me your OS version , Nodejs version and Openssl version. So that I can setup a VM here.

[indutny]

?

[Neilpang]

For me, this issue Only happens on Linux( my ubuntu 14.04), My Mac works well.

[Neilpang]

You said: "I just tried it and it works fine for me, I suppose you are building the module with node-gyp configure && node-gyp rebuild?"

Can you tell me your OS versions? So that I can set up VM here to repro.

[indutny]

I am able to reproduce it, see #8026 (comment)

[indutny]

So, this is a fix for OSX: #8029

[indutny]

Force pushed #8029 to include fix for linux too. Could you please give it a try?

You'll need to:

1. git clone git://github.com/joyent/node && cd node
2. git checkout v0.10,
3. curl https://github.com/joyent/node/pull/8029.patch | git am -s
4. ./configure
5. make -j9
6. ./node /path/to/your/sign.js

[Neilpang]

thanks, I'll check it later.

[Neilpang]

Hi,
Confirmed and fixed. Thanks.

Another question, when I build my sample project, I got '"node_shared_openssl": "true",' this line in the "build/config.gypi" file.
Does it mean Nodejs use shared Openssl lib, not linked statically?

This is the full content of the "build/config.gypi"

# Do not edit. File was generated by node-gyp's "configure" step
{
  "target_defaults": {
    "cflags": [],
    "default_configuration": "Release",
    "defines": [],
    "include_dirs": [],
    "libraries": []
  },
  "variables": {
    "clang": 0,
    "gcc_version": 48,
    "host_arch": "x64",
    "node_byteorder": "little",
    "node_install_npm": "false",
    "node_prefix": "/usr",
    "node_shared_cares": "true",
    "node_shared_http_parser": "false",
    "node_shared_libuv": "false",
    "node_shared_openssl": "true",
    "node_shared_v8": "true",
    "node_shared_zlib": "true",
    "node_tag": "",
    "node_unsafe_optimizations": 0,
    "node_use_dtrace": "false",
    "node_use_etw": "false",
    "node_use_openssl": "true",
    "node_use_perfctr": "false",
    "node_use_systemtap": "false",
    "python": "/usr/bin/python",
    "target_arch": "x64",
    "v8_enable_gdbjit": 0,
    "v8_no_strict_aliasing": 1,
    "v8_use_snapshot": "false",
    "nodedir": "/usr/include/nodejs",
    "copy_dev_lib": "true",
    "standalone_static_library": 1
  }
}

[indutny]

What does

otool -L `which node`

say?

[Neilpang]

I'm using Ubuntu now. It seems that otool is not there.

[indutny]

Oh, right:

ldd `which node`

[Neilpang]

neil@neil-U:~/Desktop/nodejstest$ ldd `which node`
    linux-vdso.so.1 =>  (0x00007fffb83d5000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fae8aab1000)
    librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007fae8a8a9000)
    libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007fae8a5a4000)
    libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fae8a29e000)
    libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007fae8a088000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fae89e69000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fae89aa3000)
    /lib64/ld-linux-x86-64.so.2 (0x00007fae8accb000)

[indutny]

Ok, I don't see libssl or libcrypto here, so it looks like node is statically compiled with openssl. I have no idea why node-gyp thinks otherwise, cc @TooTallNate

[Neilpang]

Anyways, Thanks.

[TooTallNate]

@indutny It's the nodejs package installed via apt-get is why all the dependencies are dynamically linked.

[indutny]

Oh, shit!