openssl binary from package does not know about any gost algorithm.

For example:
$ openssl dgst -md_gost94 empty.txt
unknown option '-md_gost94'

Binary, compiled from .orig.tar.gz by `./config; make` work fine.

Tested on Lenny (from source) and Squeeze (binary package), installed
all packages from src:openssl 1.0.0c-2

If you add this near the top of the /etc/ssl/openssl.cnf file:
openssl_conf = openssl_def

And this somewhere else, for instance at the end:
==== begin
[openssl_def]
engines = engine_section

[engine_section]
gost = gost_section

[gost_section]
soft_load=1
default_algorithms = ALL
==== end

It should work.

I'm planning on adding that, and other engines, for the next version.


Kurt

Package: libssl1.0.0
Version: 1.0.1e-3
Followup-For: Bug #611054

Hello,

I have tried the settings you have provided to enable GOST engine. Now I
surely can use GOST algorithms with openssl. E.g. I can securely connect
to www.cryptopro.ru:443 via s_client.

However this change (potentially) breaks other semi-unrelated packages.
First to name is dnsutils:

lumag@anuminas:/tmp/openssl-1.0.1e/crypto$ dig
GOST engine already loaded
26-Jul-2013 18:16:58.082 ENGINE_by_id failed
26-Jul-2013 18:16:58.082 error:260B606D:engine routines:DYNAMIC_LOAD:init failed:eng_dyn.c:521:
26-Jul-2013 18:16:58.083 error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:417:id=gost
dig: dst_lib_init: crypto failure

I tried to analyse this failure. Here are my findings.
libdns during initialization tries to load gost engine (correct
behaviour). It asks for ENGINE_by_id("gost") (again correct).
Then comes magic. It looks like OpenSSL's engine mechanism is broken at
this point. libgost.so was loaded when parsing config file. But it is
not added to the list of engines. Thus OpenSSL tries to load libgost
again. And then libgost detects that is was already initialized and
returns an error (look for "already loaded" in engines/ccgost/gost_eng.c).

Some more magic to demonstrate this behaviour:
# no special gost in openssl.cnf
$ openssl engine -vv
(dynamic) Dynamic engine loading support
     SO_PATH: Specifies the path to the new ENGINE shared library
     NO_VCHECK: Specifies to continue even if version checking fails (boolean)
     ID: Specifies an ENGINE id name for loading
     LIST_ADD: Whether to add a loaded ENGINE to the internal list (0=no,1=yes,2=mandatory)
     DIR_LOAD: Specifies whether to load from 'DIR_ADD' directories (0=no,1=yes,2=mandatory)
     DIR_ADD: Adds a directory from which ENGINEs can be loaded
     LOAD: Load up the ENGINE specified by other settings
$ openssl engine -vv gost
(gost) Reference implementation of GOST engine
     CRYPT_PARAMS: OID of default GOST 28147-89 parameters
$ openssl engine -vv gost dynamic
(gost) Reference implementation of GOST engine
     CRYPT_PARAMS: OID of default GOST 28147-89 parameters
(dynamic) Dynamic engine loading support
     SO_PATH: Specifies the path to the new ENGINE shared library
     NO_VCHECK: Specifies to continue even if version checking fails (boolean)
     ID: Specifies an ENGINE id name for loading
     LIST_ADD: Whether to add a loaded ENGINE to the internal list (0=no,1=yes,2=mandatory)
     DIR_LOAD: Specifies whether to load from 'DIR_ADD' directories (0=no,1=yes,2=mandatory)
     DIR_ADD: Adds a directory from which ENGINEs can be loaded
     LOAD: Load up the ENGINE specified by other settings

# Added openssl gost configuration
$ openssl engine -vv
(dynamic) Dynamic engine loading support
     SO_PATH: Specifies the path to the new ENGINE shared library
     NO_VCHECK: Specifies to continue even if version checking fails (boolean)
     ID: Specifies an ENGINE id name for loading
     LIST_ADD: Whether to add a loaded ENGINE to the internal list (0=no,1=yes,2=mandatory)
     DIR_LOAD: Specifies whether to load from 'DIR_ADD' directories (0=no,1=yes,2=mandatory)
     DIR_ADD: Adds a directory from which ENGINEs can be loaded
     LOAD: Load up the ENGINE specified by other settings
$ openssl engine -vv gost
GOST engine already loaded
3073669384:error:260B606D:engine routines:DYNAMIC_LOAD:init failed:eng_dyn.c:521:
3073669384:error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:417:id=gost
$ openssl engine -vv gost dynamic
GOST engine already loaded
3074050312:error:260B606D:engine routines:DYNAMIC_LOAD:init failed:eng_dyn.c:521:
3074050312:error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:417:id=gost
(dynamic) Dynamic engine loading support
     SO_PATH: Specifies the path to the new ENGINE shared library
     NO_VCHECK: Specifies to continue even if version checking fails (boolean)
     ID: Specifies an ENGINE id name for loading
     LIST_ADD: Whether to add a loaded ENGINE to the internal list (0=no,1=yes,2=mandatory)
     DIR_LOAD: Specifies whether to load from 'DIR_ADD' directories (0=no,1=yes,2=mandatory)
     DIR_ADD: Adds a directory from which ENGINEs can be loaded
     LOAD: Load up the ENGINE specified by other settings


As you can see, engine is loaded, but not fully represented to the rest of OpenSSL.

Hope this helps.

http://www.mail-archive.com/openssl-dev@openssl.org/msg32881.html


Kurt

Yes, this looks (more or less) like my problem. Good that upstream
acknowledges that it is a problem.

For my problem I can not add dynamic_path to my config file as I have
multi-arch (amd64 vs i386) system and adding dynamic_path would break
'other' libssl/libcrypto loading engines.

Doesn't this work with multiarch?
dynamic_path=gost


Kurt

It does not work at all:

openssl engine
Error configuring OpenSSL
140212314072744:error:25066067:DSO support routines:DLFCN_LOAD:could not
load the shared library:dso_dlfcn.c:185:filename(libgost.so):
libgost.so: cannot open shared object file: No such file or directory
140212314072744:error:25070067:DSO support routines:DSO_load:could not
load the shared library:dso_lib.c:244:
140212314072744:error:260B6084:engine routines:DYNAMIC_LOAD:dso not
found:eng_dyn.c:450:
140212314072744:error:260BC066:engine
routines:INT_ENGINE_CONFIGURE:engine configuration
error:eng_cnf.c:204:section=gost_section, name=dynamic_path, value=gost
140212314072744:error:0E07606D:configuration file
routines:MODULE_RUN:module initialization
error:conf_mod.c:235:module=engines, value=engine_section, retcode=-1

[...]

We have a ENGINESDIR at compile time pointing to the right
directly, but I can't get it to use that without giving
an other error instead.


Kurt