Skip to content

GitLab

Closed
Created by Jeffrey Walton@noloader

GnuTLS 3.6.8 and one failed self test on Fedora 29, x86_64

Description of problem:

One failed self test on Fedora 29, x86_64, fully patched. Running make check results in:

PASS: gendh
PASS: test-ciphers.sh
PASS: override-ciphers
PASS: test-hash-large.sh
PASS: crypto
FAIL: test-ciphers-api.sh
PASS: test-ciphers-openssl.sh

Version of gnutls used:

GnuTLS 3.6.8

Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)

GnuTLS from 3.6.8 source tarball. Fetched from https://www.gnupg.org/ftp/gcrypt/gnutls/v3.6/.

How reproducible:

This is very reproducible. It has been nagging me for the last couple of years.

Steps to Reproduce:

  • select an alternate location for GnuTLS and all dependencies. I select prefix=/usr/local and libdir=/usr/local/lib64
  • select flags for GnuTLS and all dependencies. I select CPPFLAGS = -I/usr/local/include -DNDEBUG, CFLAGS = -g2 -O2 -march=native -fPIC -pthread, CXXFLAGS = -g2 -O2 -march=native -fPIC -pthread and LDFLAGS = -L/usr/local/lib64 -Wl,-R,'$$ORIGIN/../lib64' -Wl,-R,/usr/local/lib64 -Wl,--enable-new-dtags.
  • build all GnuTLS dependencies
  • build GnuTLS
  • run make check before install

Build GnuTLS

The previous step says "build GnuTLS". Here is the configure used. The various variables like INSTX_PREFIX and BUILD_PKGCONFIG are internal variables passed onto Autotools.

    PKG_CONFIG_PATH="${BUILD_PKGCONFIG[*]}" \
    CPPFLAGS="${BUILD_CPPFLAGS[*]}" \
    CFLAGS="${BUILD_CFLAGS[*]}" \
    CXXFLAGS="${BUILD_CXXFLAGS[*]}" \
    LDFLAGS="${BUILD_LDFLAGS[*]}" \
    LIBS="${BUILD_LIBS[*]}" \
./configure --enable-shared \
    --prefix="$INSTX_PREFIX" \
    --libdir="$INSTX_LIBDIR" \
    --enable-seccomp-tests \
    --disable-guile \
    --disable-ssl2-support \
    --disable-ssl3-support \
    --disable-gtk-doc \
    --disable-gtk-doc-html \
    --disable-gtk-doc-pdf \
    --with-p11-kit \
    --with-libregex \
    --with-nettle-prefix="$INSTX_PREFIX" \
    --with-libiconv-prefix="$INSTX_PREFIX" \
    --with-libintl-prefix="$INSTX_PREFIX" \
    --with-libseccomp-prefix="$INSTX_PREFIX" \
    --with-unbound-root-key-file="$SH_UNBOUND_ROOTKEY_FILE"

Here is what the variables work out to:

Common flags and options:

  INSTX_BITNESS: 64-bits
   INSTX_PREFIX: /usr/local
   INSTX_LIBDIR: /usr/local/lib64
    INSTX_OPATH: '$$ORIGIN/../lib64'

PKG_CONFIG_PATH: /usr/local/lib64/pkgconfig
       CPPFLAGS: -I/usr/local/include -DNDEBUG
         CFLAGS: -g2 -O2 -march=native -fPIC -pthread
       CXXFLAGS: -g2 -O2 -march=native -fPIC -pthread
        LDFLAGS: -L/usr/local/lib64 -Wl,-R,'$$ORIGIN/../lib64' -Wl,-R,/usr/local/lib64 -Wl,--enable-new-dtags
         LDLIBS: -ldl -lpthread

Actual results:

$ make check
...

PASS: gendh
PASS: test-ciphers.sh
PASS: override-ciphers
PASS: test-hash-large.sh
PASS: crypto
FAIL: test-ciphers-api.sh
PASS: test-ciphers-openssl.sh

Expected results:

All tests pass

Files of interest

config.log.zip

test-suite.log.zip

Runtime Paths

I think this looks OK.

$ objdump -p gnutls-3.6.8/tests/slow/cipher-api-test

gnutls-3.6.8/tests/slow/cipher-api-test:     file format elf64-x86-64
...

Dynamic Section:
  NEEDED               libgnutls.so.30
  NEEDED               libp11-kit.so.0
  NEEDED               libffi.so.6
  NEEDED               libidn2.so.0
  NEEDED               libunistring.so.2
  NEEDED               libiconv.so.2
  NEEDED               libtasn1.so.6
  NEEDED               libnettle.so.6
  NEEDED               libhogweed.so.4
  NEEDED               libgmp.so.10
  NEEDED               libdl.so.2
  NEEDED               libpthread.so.0
  NEEDED               libc.so.6
  RUNPATH              $ORIGIN/../lib64:/usr/local/lib64:/home/jwalton/Build-Scripts/gnutls-3.6.8/lib/.libs:/usr/local/lib64/../lib64
  INIT                 0x0000000000401000
  FINI                 0x0000000000402888
  INIT_ARRAY           0x0000000000405d38
  INIT_ARRAYSZ         0x0000000000000008
  FINI_ARRAY           0x0000000000405d40
  FINI_ARRAYSZ         0x0000000000000008
  ...

It seems like RUNPATH should include the build directory first. Other than that, all the non-system dependencies are located at /usr/local/lib64 and should be found.

Edited by Jeffrey Walton