/usr/lib/dld.sl: Unresolved symbol: SSL_CTX_set_client_cert_cb (code) with specific user

[Jeremy_G]

Hi everyone,

First, I'm a novice in HP-UX and I'm French, so I'm sorry if my english is not perfect. 

I read many threads before posting this message and I have no idea how to solve my problem.

I have a HP-UX (HP-UX B.11.11 U 9000/800) server with Subversion (svn, version 1.8.5 (r1542147)) installed on it.

When I run this command below with the "root" user, I have no problem :

svn ls --no-auth-cache "https://myURL"

But when I run it with another user, the command fail with this error :

/usr/lib/dld.sl: Unresolved symbol: SSL_CTX_set_client_cert_cb (code)  from /usr/local/lib/libserf-1.sl
[HP ARIES32]: Core file for 32-bit PA-RISC application
[HP ARIES32]:   /usr/local/bin/svn saved to /users/interco/livexp/core.svn
Abort(coredump)

My first question is : What symbol means on HP-UX ?

My second question is : Do you know how to solve this error ?

thank for your help :)

[Steven Schweda]

> /usr/lib/dld.sl: Unresolved symbol: SSL_CTX_set_client_cert_cb (code)
>  from /usr/local/lib/libserf-1.sl

> [...] What symbol means on HP-UX ?

   It's a symbolic name of some function (or global storage) which
appears in some object library or shared object.  As a simple Web search
should tell you, SSL_CTX_set_client_cert_cb is a function in one of the
OpenSSL libraries, libssl.{a|sl|so}.

   If it works for only "root", then you might have bad permissions on
the the OpenSSL libraries, so that "root" can read them when other users
can't.  Or "root" (only) might have some LD_<something> environment
variable defined, so that "root" can find these libraries when other
users can't.

[Jeremy_G]

Hi,

Thank you for your precision.

I'm looking for the LD_* variable. The root user has nothing but the other one has it :

LD_LIBRARY_PATH=/exec/products/oracle/v10.2/lib:/lib:/usr/lib:/usr/local/lib

Is there something wrong ?

I also check for the permissions but I really don't know where I need to start. I'm looking the persmission on the /usr/lib/* and /usr/local/lib/*, expacially for the /usr/local/lib/libserf-1.sl and the /usr/lib/dld.sl. Something's wrong ?

 52226  768 -r-xr-xr-x   1 bin        bin         393216 Oct  8  2015 dld.sl

 44332  240 -rwxr-xr-x   1 root       sys         122880 Oct  7  2013 libserf-1.sl

EDIT :

Then, I don't know if it's usefull but I put the result of the nm command for the root user and the other :

LIVEXP (my user)

/usr/local/lib/libserf-1.a:ssl_buckets.o:         U SSL_CTX_set_client_cert_cb
/usr/local/lib/libssl.a:ssl_sess.o:00001dd8 T SSL_CTX_set_client_cert_cb
/usr/local/lib/libssl.sl:000636a0 T SSL_CTX_set_client_cert_cb
/usr/local/lib/libssl.sl:000636a0 T SSL_CTX_set_client_cert_cb

ROOT

/usr/local/lib/libserf-1.a:0000000000 U  SSL_CTX_set_client_cert_cb
/usr/local/lib/libssl.a:0000007640 T  SSL_CTX_set_client_cert_cb
/usr/local/lib/libssl.sl:0000407200 T  SSL_CTX_set_client_cert_cb
/usr/local/lib/libssl.sl:0000407200 T  SSL_CTX_set_client_cert_cb

Thank for your help.

[Steven Schweda]

> LD_LIBRARY_PATH=/exec/products/oracle/v10.2/lib:/lib:/usr/lib:/usr/local/lib
>
> Is there something wrong ?

   Perhaps.  What happens if you unset it?

   You might try using "lld" to tell you which shared libraries your
program uses.  For example:

dyi# type gzip                                           
gzip is /usr/contrib/bin/gzip

dyi# ldd /usr/contrib/bin/gzip
        libc.so.1 =>    /usr/lib/hpux32/libc.so.1
        libdl.so.1 =>   /usr/lib/hpux32/libdl.so.1

(That's on an IA64 system.  On PA-RISC, you'll probably see ".sl"
instead of ".so", and other paths could be different, too.  Here (IA64),
"/usr/lib/hpux32" is the default directory for 32-bit libraries.)

   If you ask about your "svn" program, then, as "root", you should see
a complete list of the shared libraries it uses,  and, as a non-"root"
user, you should see errors ("Unable to find library [...]") for the
things which it can't find.  _Those_ are the things with the problems.
My guess is that the permissions are wrong, or else you may need to add
the appropriate directory to the definition of LD_LIBRARY_PATH.

> [...] I'm looking the persmission on the /usr/lib/* and
> /usr/local/lib/*, expacially for the /usr/local/lib/libserf-1.sl and the
> /usr/lib/dld.sl.

   /usr/lib/dld.sl is the program which is complaining about not finding
SSL_CTX_set_client_cert_cb.  It's just doing its job.

      man dld.sl

   /usr/local/lib/libserf-1.sl is the thing which wants
SSL_CTX_set_client_cert_cb.  It's ok, too.

   The problem is that the dynamic loader (dld.sl) can't find all the
pieces which it needs to satisfy "svn".  In this case, something like
"libssl.sl", I'd guess.

[Dennis Handly]

> What does symbol means?

A symbol is a name for a memory address.  In this case (code) a function.

> I'm looking the permission's on the /usr/lib/* and /usr/local/lib/*, especially for the /usr/local/lib/libserf-1.sl and the /usr/lib/dld.sl.

You need to look for permissions for all components of the path.  But you would have lots more errors if /usr/ and /usr/lib/ were bad.  As Steven said, you don't need to look at dld.sl.  Nor libserf-1.sl, since that's the victim.  You need to find where it is defined.

> I put the result of the nm command for the root user and the other

They should match exactly.  Are you running these on the same machine?  And looks like defined in /usr/local/lib/libssl.sl.

[ranganath ramachandra]

You can find out which definition is resolving the reference in the working case, using ldd:

[ xint ~ ] $ ldd -y,SSL_CTX_set_client_cert_cb /usr/local/bin/svn | grep SSL_CTX_set_client_cert_cb
  SSL_CTX_set_client_cert_cb (code) : needed by /usr/local/lib/libneon.sl; found in /usr/local/lib/libssl.sl

[Jeremy_G]

Thanks everybody for your answer, it's very userful !

But for this moment, the support check my server beacause I erase some librairiesof svn. I don't really know how I  do that ... :-(

I guess they will reinstall Subversion. If that no solved my problem, I come back and test your command :-)

In any case, thank for all.