search

wbond / oscrypto

Compiler-free Python crypto library backed by the OS, supporting CPython and PyPy
MIT License
320 stars 70 forks source link

Presence of libssl3 causes issues. #55

Closed brianthelion closed 2 years ago

brianthelion commented 2 years ago

I'm fooling around with the daily builds of the upcoming (22.04) Ubuntu release.

Two things to know about 22.04 are:

  1. It comes with libssl3 installed and defaulted.
  2. libcrypto.so.3 has a different symbol table than libcrypto.so.1.1.

I'm not sure if 2 is an upstream bug or not, but I thought I'd give oscrypto notice insofar as your docs only mention <= OpenSSL 1.1.

The specific traceback I'm seeing is:

File "/home/.../lib/python3.9/site-packages/certbuilder/__init__.py", line 904, in build
    signature = sign_func(signing_private_key, tbs_cert.dump(), self._hash_algo)
  File "/home/.../lib/python3.9/site-packages/oscrypto/_openssl/asymmetric.py", line 1494, in rsa_pkcs1v15_sign
    return _sign(private_key, data, hash_algorithm)
  File "/home/.../lib/python3.9/site-packages/oscrypto/_openssl/asymmetric.py", line 1809, in _sign
    buffer_size = libcrypto.EVP_PKEY_size(private_key.evp_pkey)
  File "/home/.../lib/python3.9/site-packages/cffi/api.py", line 912, in __getattr__
    make_accessor(name)
  File "/home/.../lib/python3.9/site-packages/cffi/api.py", line 908, in make_accessor
    accessors[name](name)
  File "/home/.../lib/python3.9/site-packages/cffi/api.py", line 838, in accessor_function
    value = backendlib.load_function(BType, name)
AttributeError: function/symbol 'EVP_PKEY_size' not found in library 'libcrypto.so.3': /lib/x86_64-linux-gnu/libcrypto.so.3: undefined symbol: EVP_PKEY_size
wbond commented 2 years ago

This is helpful - thank you.

The first step will be to detect newer versions and error out. The second step will be to determine all of the APIs that have changed so that it works properly with libssl3.

wbond commented 2 years ago

I've actually gotten master to work with OpenSSL 3.0 from the 22.04 nightly.

My hope will be to cut version 1.3.0 of oscrypto in the next few days.

wbond commented 2 years ago

master now has support for OpenSSL 3.0, both with and without the legacy provider. There are CI instances set up to run the test suite against OpenSSL 3.0 on Ubuntu 22.04 and macOS 10.15.