View previous topic :: View next topic |
Author |
Message |
nordic bro Guru
Joined: 25 Oct 2003 Posts: 585
|
Posted: Tue Mar 13, 2007 9:11 pm Post subject: ntp/openssl - real unsure what to do |
|
|
Hi -
I just recently followed the amd64 handbook for installing on a new core2 machine. This is my first 64b so I'm a little confused over emul, two different lib dirs, etc. And since I'm guessing openssl is one of those thing you don't want to mess with if you don't know what it is, I'm posting before I make a mess.
I just installed ntp (http://gentoo-wiki.com/HOWTO_NTP) but whenever I try to start it I get " ntpd: OpenSSL version mismatch. Built against 90804f, you have 9070af". Google just turned up some ntp dev mailing list patches.
So I looked at /usr/lib64 (/usr/lib) and it has libssl.so.0.9.7.
But /usr/lib32 has libssl.so.0.9.8.
When I "epm -qa|grep ssl" I get openssl-0.9.7j which epm -ql says has nothing in /usr/lib32.
But when I look at portage/distfiles I only see openssl-0.9.8d.tbz2
So:
1. why two different revs/does it matter (seems to for ntp I'm guessing)?
2. where'd the second libssl come from?
3. how do I fix it or ntp? |
|
Back to top |
|
|
wynn Advocate
Joined: 01 Apr 2005 Posts: 2421 Location: UK
|
Posted: Wed Mar 14, 2007 9:49 am Post subject: |
|
|
If you have just finished installing, have you run "emerge -e system" and "emerge -e world" to sanitize your toolchain?
The multilib thing should be in the default amd64 profile Code: | # l /etc/make.profile
0 lrwxrwxrwx 1 root root 50 Sep 3 2006 /etc/make.profile -> ../usr/portage/profiles/default-linux/amd64/2006.1/ | which, I think, should give you multilib.
multilib causes glibc to be compiled twice, once to create a 64-bit library and again to create a 32-bit library. gcc is the same, there is a 32-bit gcc and a 64-bit gcc.
Here, on an AMD64 system Code: | # l /usr/lib{32,64}/libssl.so*
0 lrwxrwxrwx 1 root root 15 Feb 24 09:05 /usr/lib32/libssl.so -> libssl.so.0.9.8*
240 -rwxr-xr-x 1 root root 240100 Feb 24 09:05 /usr/lib32/libssl.so.0.9.8*
0 lrwxrwxrwx 1 root root 15 Oct 7 11:23 /usr/lib64/libssl.so -> libssl.so.0.9.8*
288 -r-xr-xr-x 1 root root 289360 Oct 7 11:23 /usr/lib64/libssl.so.0.9.8* | so it looks as though your openssl emerge hasn't worked properly or it has left an old libssl.so.0.9.7 behind.
Has /usr/lib64 only got libssl.so.0.9.7? or has it got libssl.so.0.9.8 as well as libssl.so.0.9.7? _________________ The avatar is jorma, a "duck" from "Elephants Dream": the film and all the production materials have been made available under a Creative Commons Attribution 2.5 License, see orange.blender.org for details. |
|
Back to top |
|
|
nordic bro Guru
Joined: 25 Oct 2003 Posts: 585
|
Posted: Wed Mar 14, 2007 8:02 pm Post subject: |
|
|
I completed the main install ~2 weeks ago and have not run either emerge cmd - should I? I looked at --emptytree and admit I don't understand its purpose or if it's too late for whatever reason to run it. I've emerge'd lots since (xfce, apps, /etc pkgs, etc.).
/etc/make.profile is linked to amd64 as you indicate (and I use "ACCEPT=amd64" and "CHOST="x86_64-pc-linux-gnu" in make.conf).
I have an /emul dir I feared got there from doing an rpm2targz but am 99.99% now that gentoo put it there so that's ok (a libc, couple libg++ and libstdc++'s).
I mention this because I did a couple rpm2targz installs and although it's possible, I think it's extremely unlikely one of them put the curious libssl files in place. One was a colortail patch and as best as I can remember the other was another inconsequential util but since I tried/deleted both I can't say exactly what it was (might've been xmms). Plus I usually untar those things in a tmp dir somewhere just to see what it's going to install so it's very unlikely I would've overlooked something as scary as libssl being overwritten.
Timestamps are odd too - the /etc/ssl dirs' timestamps coincide with those of /usr/lib32/libssl* but according to epm I don't have any libssl stuff installed in /usr/lib32, only the older libssl* stuff in /usr/lib64.
Would some other emerge'd pkg have put them there?
/usr/lib -> lib64:
Code: |
l /usr/lib/libssl*
-rw-r--r-- 1 root 408054 Aug 9 06 17:49 /usr/lib/libssl.a
lrwxrwxrwx 1 root 11 Feb 23 07 00:59 /usr/lib/libssl.so -> libssl.so.0
lrwxrwxrwx 1 root 15 Feb 23 07 00:59 /usr/lib/libssl.so.0 -> libssl.so.0.9.7
-r-xr-xr-x 1 root 222696 Aug 9 06 17:49 /usr/lib/libssl.so.0.9.7
|
/usr/lib32:
Code: |
l /usr/lib32/libssl*
-rw-r--r-- 1 root 381374 Feb 24 07 20:20 /usr/lib32/libssl.a
lrwxrwxrwx 1 root 15 Feb 24 07 20:21 /usr/lib32/libssl.so -> libssl.so.0.9.8
-rwxr-xr-x 1 root 240100 Feb 24 07 20:20 /usr/lib32/libssl.so.0.9.8
|
Code: |
l /etc/ssl
total 28
drwxr-xr-x 2 root 8192 Feb 24 07 20:20 certs
drwxr-xr-x 2 root 4096 Feb 24 07 20:30 misc
-rw-r--r-- 1 root 9374 Feb 24 07 20:20 openssl.cnf
drwxr-xr-x 2 root 4096 Feb 24 07 20:20 private
|
Code: |
epm -qa | grep ssl
openssl-0.9.7j |
Code: |
epm -ql openssl | grep lib
/usr/lib64/libssl.so.0.9.7
/usr/lib64/pkgconfig/openssl.pc
/usr/lib64/libcrypto.a
/usr/lib64/libssl.a
/usr/lib64/libssl.so.0
/usr/lib64/libcrypto.so.0.9.7
/usr/lib64/libcrypto.so.0
/usr/share/man/man3/ERR_lib_error_string.3ssl.gz
/usr/share/man/man3/SSL_library_init.3ssl.gz
/usr/lib64/libssl.so
/usr/lib64/libcrypto.so
/usr/share/man/man3/ERR_get_next_error_library.3ssl.gz
|
Code: |
l /usr/portage/distfiles/*ssl*
2350315 2007-02-24 20:20 /usr/portage/distfiles/cups-1.2.6-nossl.tbz2
1858485 2007-02-24 20:19 /usr/portage/distfiles/openssl-0.9.8d.tbz2
|
I have done some emerge --sync's since install, and distfiles/ looks like I do have 0.9.8 installed but epm says otherwise and also says ssl libs go in lib64, not lib32 where the newer ssl is (and whose /etc/ssl* timestamps seem to belong to the /usr/lib32/libssl). if I emerge openssl again, it ostensibly will leave /usr/lib32/libssl untouched so how do I resolve this? Does gentoo even know it's there?
AFAICT I'm not having a single problem with anything - it wasn't until emerge'ing ntp yesterday that I even found out about this. But now that I'm here I don't know how to sort this out without breaking who-knows-what. |
|
Back to top |
|
|
wynn Advocate
Joined: 01 Apr 2005 Posts: 2421 Location: UK
|
Posted: Wed Mar 14, 2007 8:31 pm Post subject: |
|
|
The 0.9.7 may have come from the stage3 you downloaded.
You can run emerge -e system and emerge -e world but it will take much longer as you have many more packages to recompile. Probably best to leave it now but keep it as an option if you get segfaults from packages which should be stable.
The emul package appears to be needed for things you have emerge'd as -bin, like firefox-bin and openoffice-bin.
I don't know epm but it is probably similar to eix and is likely to look in /var/db/pkg/dev-libs/openssl-x.x.x/CONTENTS to get the information.
Perhaps you could try emerge -av dev-libs/openssl, the current stable version is 0.9.8d
P.S. ntpd uses libcrypto, part of the OpenSSL package. _________________ The avatar is jorma, a "duck" from "Elephants Dream": the film and all the production materials have been made available under a Creative Commons Attribution 2.5 License, see orange.blender.org for details. |
|
Back to top |
|
|
nordic bro Guru
Joined: 25 Oct 2003 Posts: 585
|
Posted: Thu Mar 15, 2007 5:53 pm Post subject: |
|
|
wynn wrote: | Perhaps you could try emerge -av dev-libs/openssl, the current stable version is 0.9.8d |
Ok, I did that and re-emerge'd ntp and at least ntpd is happy and starting fine now - thanks.
Doing the emerge a msg popped up saying it was leaving behind an old ssl and that I should run revdep* myself; I was hoping it meant it found the lib32 ssl and wanted to remove it but unfortunately it was the lib64 ssl the emerge had just obsoleted
But when I run revdep* I get nothing except "grep broken pipe" so can't see what it's trying to tell me
I guess I'll have to remove lib32 ssl by hand at some point and see what happens. Maybe I'll do that before trying the system/world emerge cmds you posted.
Thanks for the help/explanations... |
|
Back to top |
|
|
wynn Advocate
Joined: 01 Apr 2005 Posts: 2421 Location: UK
|
Posted: Thu Mar 15, 2007 6:20 pm Post subject: |
|
|
The revdep-rebuild command to use is Code: | # revdep-rebuild --library 'lib\(ssl\|crypto\).so.0.9.7' -p | This will look for all packages, executables and shared libraries, which use either libssl-0.9.7 or libcrypto-0.9.7 and the "-p" at the end is for emerge to "pretend".
If you are happy with the list then you can run the command again without the "-p".
Removing the lib32 ssl by hand is a good idea â at the very least it will show up the culprits which are still using it (if any) _________________ The avatar is jorma, a "duck" from "Elephants Dream": the film and all the production materials have been made available under a Creative Commons Attribution 2.5 License, see orange.blender.org for details. |
|
Back to top |
|
|
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
|