<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have a Linux application which can load a lot of different .so modules at runtime, which in turn might be contain various third-party libraries. In the past we have seen the problems that there might appear different binarily incompatible
openssl versions in the process memory, which might get mixed up and cause crashes or worse. The worst offender was libpython which can install and load its own modules on fly, with totally uncontrollable openssl versions in them.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We attempted to fight with this by compiling static openssl libraries with -fvisibility=hidden and linking our own .so-s against it. This ought to hide the symbols from Python at least. It looks like this actually worked with openssl-1.1.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Alas, now we are switching over to openssl-3.0 (the fresh 3.0.7) and it looks like this approach does not work anymore. We are getting initialization errors, I think from OSSL_PROVIDER_load(“legacy”) or such.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">s2n_init() failed: 402653268 (Failed to load or unload an openssl provider)<o:p></o:p></p>
<p class="MsoNormal">Fatal error condition occurred in /srv/paavo/DataAnalysis/Acapella/trunk/Production/Intermediates/ThirdParty/src/aws-sdk-cpp/crt/aws-crt-cpp/crt/aws-c-io/source/s2n/s2n_tls_channel_handler.c:197: 0 && "s2n_init() failed"<o:p></o:p></p>
<p class="MsoNormal">Exiting Application<o:p></o:p></p>
<p class="MsoNormal">No call stack information available<o:p></o:p></p>
<p class="MsoNormal">Aborted (core dumped)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Removing the -fvisibility=hidden flag from openssl compilation gets rid of this problem, but I’m afraid this may cause conflicts with python again.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So my question is should this usage work, and if so, how to get it working?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">TIA<o:p></o:p></p>
<p class="MsoNormal">Paavo<o:p></o:p></p>
</div>
</body>
</html>