ZBUG-3355 : Upgrade OpenSSL to 3.0.9

[umagmrit]

No description provided.

[ghen2]

Hi

On a CentOS 7 system, I noticed that several Zimbra components, including openldap (slap* and ldap* tools) and postfix, link to both the Zimbra-provided openssl 3.0.9 libraries AND the OS's openssl 1.0.2 libraries at the same time:

$ ldd /opt/zimbra/common/bin/ldapsearch | grep -e libssl -e libcrypto
        libssl.so.3 => /opt/zimbra/common/lib/libssl.so.3 (0x00007ffa96786000)
        libcrypto.so.3 => /opt/zimbra/common/lib/libcrypto.so.3 (0x00007ffa96159000)
        libssl.so.10 => /lib64/libssl.so.10 (0x00007ffa954ac000)
        libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00007ffa95049000)

This can be traced down to libcurl, as indeed curl links to the OS-provided libssh2 on one hand –which in turn links to the OS-provided openssl– and to the Zimbra-provided openssl on the other hand, as evinced by curl's config.log:

configure:27788: checking run-time libs availability
configure:27805: gcc -o conftest -O2 -Wno-system-headers  -I/opt/zimbra/common/include    -Wl,-rpath,/opt/zimbra/common/lib -L/opt/zimbra/common/lib    conftest.c -lssh2  -lssl -lcrypto -lssl -lcrypto   -lgssapi -lz  >&5
/usr/bin/ld: warning: libssl.so.10, needed by /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/libssh2.so, may conflict with libssl.so.3
/usr/bin/ld: warning: libssl.so.10, needed by /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/libssh2.so, may conflict with libssl.so.3
/usr/bin/ld: warning: libcrypto.so.10, needed by /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/libssh2.so, may conflict with libcrypto.so.3
/usr/bin/ld: warning: libcrypto.so.10, needed by /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/libssh2.so, may conflict with libcrypto.so.3

This is not due to this particular OpenSSL 3.0.9 upgrade, it was like this before as well.

I'm not sure this is actually a problem, but it may be worth looking into. The libcurl dependency is brought in via cyrus-sasl, and thus further leaks its link dependencies into openldap and postfix binaries. I'm not sure whether the libcurl dependency is actually needed for cyrus-sasl? (or whether libcurl actually needs the libssh2 dependency?)

[umagmrit]

Hi

On a CentOS 7 system, I noticed that several Zimbra components, including openldap (slap* and ldap* tools) and postfix, link to both the Zimbra-provided openssl 3.0.9 libraries AND the OS's openssl 1.0.2 libraries at the same time:

$ ldd /opt/zimbra/common/bin/ldapsearch | grep -e libssl -e libcrypto
        libssl.so.3 => /opt/zimbra/common/lib/libssl.so.3 (0x00007ffa96786000)
        libcrypto.so.3 => /opt/zimbra/common/lib/libcrypto.so.3 (0x00007ffa96159000)
        libssl.so.10 => /lib64/libssl.so.10 (0x00007ffa954ac000)
        libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00007ffa95049000)

This can be traced down to libcurl, as indeed curl links to the OS-provided libssh2 on one hand –which in turn links to the OS-provided openssl– and to the Zimbra-provided openssl on the other hand, as evinced by curl's config.log:

configure:27788: checking run-time libs availability
configure:27805: gcc -o conftest -O2 -Wno-system-headers  -I/opt/zimbra/common/include    -Wl,-rpath,/opt/zimbra/common/lib -L/opt/zimbra/common/lib    conftest.c -lssh2  -lssl -lcrypto -lssl -lcrypto   -lgssapi -lz  >&5
/usr/bin/ld: warning: libssl.so.10, needed by /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/libssh2.so, may conflict with libssl.so.3
/usr/bin/ld: warning: libssl.so.10, needed by /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/libssh2.so, may conflict with libssl.so.3
/usr/bin/ld: warning: libcrypto.so.10, needed by /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/libssh2.so, may conflict with libcrypto.so.3
/usr/bin/ld: warning: libcrypto.so.10, needed by /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/libssh2.so, may conflict with libcrypto.so.3

This is not due to this particular OpenSSL 3.0.9 upgrade, it was like this before as well.

I'm not sure this is actually a problem, but it may be worth looking into. The libcurl dependency is brought in via cyrus-sasl, and thus further leaks its link dependencies into openldap and postfix binaries. I'm not sure whether the libcurl dependency is actually needed for cyrus-sasl? (or whether libcurl actually needs the libssh2 dependency?)

@ghen2 I think libcurl-devel, libssh2-devel are required for cyrus-sasl.

without libcurl-devel:
depbase=echo zmpost.o | sed 's|[^/]*$|.deps/&|;s|\.o$||';\

gcc -DHAVE_CONFIG_H -DSASLAUTHD_CONF_FILE_DEFAULT="/opt/zimbra/conf/saslauthd.conf" -I. -I. -I.. -I. -I.. -I../include -I../include -I../common -I../common -DOBSOLETE_CRAM_ATTR=1 -I/opt/zimbra/common/include -DOBSOLETE_DIGEST_ATTR=1 -I/opt/zimbra/common/include -I/opt/zimbra/common/include/libxml2 -Wall -W -O2 -g -D_REENTRANT -MT zmpost.o -MD -MP -MF $depbase.Tpo -c -o zmpost.o zmpost.c &&\

mv -f $depbase.Tpo $depbase.Po

zmpost.c:1:23: fatal error: curl/curl.h: No such file or directory

#include <curl/curl.h>

                   ^

compilation terminated.

without libssh2-devel:

/bin/sh ../libtool --tag=CC --mode=link gcc -Wall -W -O2 -g -D_REENTRANT -version-info 3:0:0 -no-undefined -L/opt/zimbra/common/lib -Wl,-rpath,/opt/zimbra/common/lib -L/opt/zimbra/common/lib -Wl,-rpath,/opt/zimbra/common/lib -Wl,-rpath,/opt/zimbra/common/lib -L/opt/zimbra/common/lib -o libsasl2.la -rpath /opt/zimbra/common/lib auxprop.lo canonusr.lo checkpw.lo client.lo common.lo config.lo external.lo md5.lo saslutil.lo server.lo seterror.lo dlopen.lo -ldl ../common/libplugin_common.la -lresolv -lcurl -L/opt/zimbra/common/lib -lxml2 -lz -lm -ldl
libtool: link: gcc -shared -fPIC -DPIC .libs/auxprop.o .libs/canonusr.o .libs/checkpw.o .libs/client.o .libs/common.o .libs/config.o .libs/external.o .libs/md5.o .libs/saslutil.o .libs/server.o .libs/seterror.o .libs/dlopen.o -Wl,--whole-archive ../common/.libs/libplugin_common.a -Wl,--no-whole-archive -Wl,-rpath -Wl,/opt/zimbra/common/lib -Wl,-rpath -Wl,/opt/zimbra/common/lib -L/opt/zimbra/common/lib /opt/zimbra/common/lib/libcurl.so -lssh2 -lssl -lcrypto /opt/zimbra/common/lib/libgssapi.so /opt/zimbra/common/lib/libheimntlm.so /opt/zimbra/common/lib/libkrb5.so /opt/zimbra/common/lib/libheimbase.so /opt/zimbra/common/lib/libhx509.so /opt/zimbra/common/lib/libwind.so /opt/zimbra/common/lib/libheimsqlite.so /opt/zimbra/common/lib/libhcrypto.so /opt/zimbra/common/lib/libasn1.so /opt/zimbra/common/lib/libcom_err.so /opt/zimbra/common/lib/libroken.so -lcrypt -lresolv /opt/zimbra/common/lib/libxml2.so -lz -lm -ldl -O2 -Wl,-rpath -Wl,/opt/zimbra/common/lib -Wl,-rpath -Wl,/opt/zimbra/common/lib -Wl,-rpath -Wl,/opt/zimbra/common/lib -pthread -Wl,-soname -Wl,libsasl2.so.3 -o .libs/libsasl2.so.3.0.0
/bin/ld: cannot find -lssh2
collect2: error: ld returned 1 exit status

[root@centos-7 cyrus-sasl]# ldd /usr/lib64/libcurl.so |grep -i  libssh2
	libssh2.so.1 => /lib64/libssh2.so.1 (0x00007fd85e729000)