Despite having chosen OpenSSL from ports, linking is done by first searching /usr/lib and then /usr/local/lib, not the other way around. No wonder the linker can't find the symbols originating in OpenSSL 1.0.2p.

Affect me too on kernel r342378 and ports from December 23, 2018. Is there any workaround or fix?

(In reply to Matthias Apitz from comment #2)
My issues with emulators/virtualbox-ose was eventually solved by changing from ssl=openssl and back to ssl=base for DEFAULT_VERSIONS in /etc/make.conf. Most ports are now compatible with OpenSSL 1.1.1a from base on stable/12 and head.

Order was eventually restored when this and other ports became compatible with OpenSSL 1.1.1a from base.

it does not link on kernel r342378 with recent ports in poudriere, not with ssl=openssl and not with ssl=base

the PR should be re-openef

[guru@jet ~]$ uname -a
FreeBSD jet 13.0-CURRENT FreeBSD 13.0-CURRENT r342378 GENERIC  amd64
[guru@jet ~]$ ls -l /usr/lib/libssl*
-r--r--r--  1 root  wheel  4461146 Dec 23 17:44 /usr/lib/libssl.a
lrwxr-xr-x  1 root  wheel       13 Dec 23 17:44 /usr/lib/libssl.so -> libssl.so.111
-r--r--r--  1 root  wheel   613376 Dec 23 17:44 /usr/lib/libssl.so.111
-r--r--r--  1 root  wheel  4568782 Dec 23 17:44 /usr/lib/libssl_p.a

[guru@jet ~]$ ls -l virtualbox-ose-5.2.22_2.log-*
-rw-r--r--  1 guru  wheel  1519253 Dec 27 17:21 virtualbox-ose-5.2.22_2.log-base
-rw-r--r--  1 root  wheel  1519513 Dec 27 00:05 virtualbox-ose-5.2.22_2.log-openssl

[guru@jet ~]$ grep HMAC_CTX_cleanup virtualbox-ose-5.2.22_2.log-*
virtualbox-ose-5.2.22_2.log-base:ld: error: undefined symbol: HMAC_CTX_cleanup
virtualbox-ose-5.2.22_2.log-openssl:ld: error: undefined symbol: HMAC_CTX_cleanup


[guru@jet ~]$ nm /usr/lib/libssl.a | grep -i HMAC_CTX_cleanup

Created attachment 200568 [details]
poudriere log compiling against SSL in base

Created attachment 200569 [details]
poudriere log compiling against OpenSSL

Reopening as this case isn't solved for everyone.

As a counter to the build problems others are experiencing, here's my successful synth build log from Chrissy Day:
https://ximalas.info/~trond/virtualbox-ose/emulators___virtualbox-ose-2018-12-25.log

I have had a look in the provided log file of the synth build; it says among other things:

emulators___virtualbox-ose-2018-12-25.log:
...
DEFAULT_VERSIONS+=samba=4.7
DEFAULT_VERSIONS+=ssl=base
#DEFAULT_VERSIONS+=ssl=openssl

...
Checking for ssl: found version OpenSSL 1.1.1a-freebsd  20 Nov 2018, OK.
...

my log file says:

virtualbox-ose-5.2.22_2.log-base:
...
.if ${.CURDIR:M*/emulators/virtualbox-ose}
DEFAULT_VERSIONS=ssl=base
.endif
...
Checking for ssl: found version OpenSSL 1.1.1a-freebsd  20 Nov 2018, OK.
...

kBuild: Linking VBoxDTrace
ld: error: undefined symbol: SSL_load_error_strings
>>> referenced by tcp.c:314 (/wrkdirs/usr/ports/emulators/virtualbox-ose/work/VirtualBox-5.2.22/src/VBox/RDP/client-1.8.3/tcp.c:314)
>>>               /wrkdirs/usr/ports/emulators/virtualbox-ose/work/VirtualBox-5.2.22/out/freebsd.amd64/release/obj/rdesktop-vrdp/tcp.o:(tcp_tls_connect)

a look into the compiled source has:

# find * -exec grep -H SSL_load_error_strings {} \;
src/VBox/RDP/client-1.8.3/tcp.c:                SSL_load_error_strings();
src/VBox/Runtime/VBox/VBoxRTDeps.cpp:    (PFNRT)SSL_load_error_strings,
src/VBox/Runtime/r3/win/VBoxRT-openssl-pre-1.1.def:    SSL_load_error_strings


src/VBox/RDP/client-1.8.3/tcp.c:

...
/* Establish a SSL/TLS 1.0 connection */
RD_BOOL
tcp_tls_connect(void)
^^^^^^^^^^^^^^^
{
        int err;
        long options;

        if (!g_ssl_initialized)
        {
                SSL_load_error_strings();
                ^^^^^^^^^^^^^^^^^^^^^^^^^
                SSL_library_init();
                ^^^^^^^^^^^^^^^^^^^
                g_ssl_initialized = True;
        }

        /* create process context */
        if (g_ssl_ctx == NULL)
        {
...


a look into the SSL library in base shows:

[root@jet ~]# uname -a
FreeBSD jet 13.0-CURRENT FreeBSD 13.0-CURRENT r342378 GENERIC  amd64
[root@jet ~]# strings /usr/lib/libssl.a | grep OpenSSL
OpenSSL 1.1.1a-freebsd  20 Nov 2018
[root@jet ~]# nm /usr/lib/libssl.a | grep SSL_load_error_strings

i.e. the missing symbol SSL_load_error_strings is not in my library in base; 

I'm clueless how this can link in the system where it works;

can the OP please check two things:

1. the resulting object file ..../tcp.o if this contains a reference to SSL_load_error_strings, and if not why?
2. the library /usr/lib/libssl.a if this contains the symbol SSL_load_error_strings, and if not how this can be resolved for tcp.o

(In reply to Matthias Apitz from comment #11)
uname -a
FreeBSD FQDN 12.0-STABLE FreeBSD 12.0-STABLE #0 r342575: Fri Dec 28 19:16:59 CET 2018     root@FQDN:/usr/obj/usr/src/amd64.amd64/sys/E5530  amd64

strings /usr/lib/libssl.a | grep OpenSSL
OpenSSL 1.1.1a-freebsd  20 Nov 2018

nm /usr/lib/libssl.a | grep SSL_load_error_strings
[nothing found]

On inspection of /usr/include/openssl/ssl.h, I came across this, around line 1595:

# if OPENSSL_API_COMPAT < 0x10100000L
#  define SSL_load_error_strings() \
    OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS \
                     | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL)
# endif

nm .../VirtualBox-5.2.22/out/freebsd.amd64/release/obj/rdesktop-vrdp/tcp.o

                 U __error
                 U __inet_addr
                 U __stdoutp
                 U close
                 U connect
                 U ERR_print_errors_fp
                 U error
                 U EVP_PKEY_free
0000000000000058 b g_in
                 U g_network_error
0000000000000000 b g_out
                 U g_reconnect_loop
00000000000000a0 b g_run_ui
0000000000000050 b g_sock
0000000000000048 b g_ssl
00000000000000a8 b g_ssl_ctx
00000000000000a4 b g_ssl_initialized
0000000000000000 D g_tcp_port_rdp
                 U g_user_quit
                 U gethostbyname
                 U getpeername
                 U getsockname
                 U getsockopt
                 U i2d_PublicKey
                 U OPENSSL_init_ssl
                 U recv
                 U select
                 U send
                 U setsockopt
                 U socket
                 U sprintf
                 U SSL_connect
                 U SSL_CTX_free
                 U SSL_CTX_new
                 U SSL_CTX_set_options
                 U SSL_free
                 U SSL_get_error
                 U SSL_get_peer_certificate
                 U SSL_get_shutdown
                 U SSL_new
                 U SSL_pending
                 U SSL_read
                 U SSL_set_fd
                 U SSL_shutdown
                 U SSL_write
                 U strerror
0000000000000710 T tcp_connect
00000000000008e0 T tcp_disconnect
0000000000000950 T tcp_get_address
00000000000000b0 b tcp_get_address.ipaddr
0000000000000000 T tcp_init
00000000000009c0 T tcp_is_connected
0000000000000260 T tcp_recv
0000000000000a00 T tcp_reset_state
0000000000000a80 T tcp_run_ui
0000000000000060 T tcp_send
00000000000004e0 T tcp_tls_connect
0000000000000620 T tcp_tls_get_server_pubkey
                 U TLSv1_client_method
                 U ui_select
                 U X509_free
                 U X509_get_pubkey
                 U xfree
                 U xmalloc
                 U xrealloc

I have a hypothesis that my global ccache might be fooling me, although I made sure to really empty my ccache after upgrading base from 11.2 to 12.0 back in late October. I'll rename my existing ccache, create a new one, and see how that goes. I haven't removed security/openssl from my LiveSystem since net/rdesktop needs it, but that should not affect synth and its chroots. rdesktop and OpenSSL from ports might go away once I'm familiar with net/remmina.

Some months ago I was struck by a mishap where Subversion left some subtrees untouched because I had edited some files here and there. Since then I always run svn up --accept=theirs-full --non-interactive /usr/ports to get rid of my own conflicting changes and ensuring the entire ports tree is always correct. The only change I have in effect are some changes to Mk/bsd.gecko.mk to allow for the use of ccache and a couple of extra patchfiles for ports-mgmt/synth, and all those changes should be benign.

(In reply to Trond.Endrestol from comment #12)
My hypothesis has been falsified:

ccache -s

cache directory                     /var/cache/ccache
primary config                      /var/cache/ccache/ccache.conf
secondary config      (readonly)    /usr/local/etc/ccache.conf
stats zero time                     Sun Dec 30 13:44:01 2018
cache hit (direct)                     0
cache hit (preprocessed)               0
cache miss                             0
cache hit rate                      0.00 %
called for link                       26
no input file                         94
cleanups performed                     0
files in cache                         0
cache size                           0.0 kB
max cache size                      32.0 GB

ccache isn't used by emulators/virtualbox-ose.

(In reply to Trond.Endrestol from comment #12)
Based on your findings, I tried in the make.conf file for poudriere:

.if ${.CURDIR:M*/emulators/virtualbox-ose}
DEFAULT_VERSIONS+=ssl=base
CFLAGS+= -DOPENSSL_API_COMPAT=0
.endif

but this does no change anything;

Created attachment 200668 [details]
vbox-ose.patch

I actually fixed this on my own system by patching src/VBox/RDP/client-1.8.3/Makefile.kmk to not include /usr/lib in the LIBPATH of the RDP client. (The rest of the patch actually includes a fix from bug #228219, since I was including that in my local tree at the time, so if you want to ignore the Config.kmk patch for this bug, that's fine, I could resubmit without that portion.)

(In reply to Naram Qashat from comment #15)
Oh, I should point out that I was compiling with libressl as opposed to openssl from ports. But I believe this should fix the latter as well, I hope.

(In reply to Matthias Apitz from comment #14)
Being back at $WORK, I created a VM running the 13.0-CURRENT snapshot from Boxing Day, r342541. Nothing fancy this time, only base on UFS.

I did roughly this:

mkdir -p /var/spool/workdirs
[I edited /etc/make.conf adding WRKDIRPREFIX=/var/spool/workdirs]
cd /usr
svnlite co svn://svn.FQDN/freebsd/base/head src # I have an unofficial svn mirror at $WORK, base and ports resides in a (sub)directory called freebsd
mkdir ports
svnlite co svn://svn.FQDN/freebsd/ports/head ports
cd ports/ports-mgmt/pkg
make install
[this also pulled in ports-mgmt/dialog4ports]
cd ../dialog4ports
make package
[just to make sure I have a package of it for future reference]
cd ../../emulators/virtualbox-ose
make config-recursive
[I could have defined BATCH, but I went ahead and accepted the defaults]
make package && make install && make package-recursive
[at some point graphics/mesa-libs complained about Python being 3.6, but wanting 2.7]
pushd ../../lang/python
make package && make install
cd ../python2
make package && make install
cd ../python3
make package && make install
popd
make package && make install && make package-recursive

After 4 hours had passed, emulators/virtualbox-ose was not only compiled successfully, but also installed and ready to rock and/or roll. Q.E.D.

(In reply to Naram Qashat from comment #15)

I copied your patch into the poudriere port's tree as:

# ls -ltr /usr/local/poudriere/ports/ports-20181223/emulators/virtualbox-ose/files/
...
-rw-r--r--  1 root  wheel    397 Dec 23 19:45 patch-src-VBox-Installer-freebsd-virtualbox.desktop
-rw-r--r--  1 root  wheel    629 Dec 23 19:45 patch-src-recompiler-Sun-testmath.c
-rw-r--r--  1 root  wheel   6916 Jan  7 19:11 vbox-ose.patch

and the result is: no change. I'm even not sure if your patch gets applied at all if I have a look into the names of the other patch files...

Can you please provide a patch which fits into mulators/virtualbox-ose/files/ ?

Well, the workaround really still is to exclude /usr/lib from src/VBox/RDP/client-1.8.3/Makefile.kmk file (1 occurence).

Then emulators/virtualbox-ose builds fine.

Created attachment 201101 [details]
patch file to be placed in emulators/virtualbox-ose/files with this name

in addition to the proposed patch I have in the jails make.conf (/usr/local/etc/poudriere.d/freebsd-r342378-make.conf):

# /usr/ports/emulators/virtualbox-ose
.if ${.CURDIR:M*/emulators/virtualbox-ose}
DEFAULT_VERSIONS+=ssl=openssl
# DEFAULT_VERSIONS+=ssl=base
.endif

with this, poudriere builds fine the port.

My patch works if you use patch on the emulators/virtualbox-ose directory, it isn't meant to be placed directly into the files directory.

Created attachment 201925 [details]
patch

This works for me: more correct libressl porting.

Created attachment 201930 [details]
patch without private changes

Created attachment 205167 [details]
patch patch-src-VBox-RDP-client-1.8.4-Makefile.kmk

I've updated my patch file patch-src-VBox-RDP-client-1.8.4-Makefile.kmk (to be placed into emulators/virtualbox-ose/files) to port version 5.2.30

I think this should be commited.

in the file: 
work/VirtualBox-5.2.26/src/VBox/RDP/client-1.8.3/Makefile.kmk 

I did't remove the `/usr/lib' string,
I replaced it with /usr/local/lib 

where:
...
rdesktop-vrdp_LIBPATH = \ 
/usr/lib \ 
... 
comes like:
...
rdesktop-vrdp_LIBPATH = \ 
/usr/local/lib \ 
... 

and build finished fine.

thanks for your comments, they really helped me out.

Created attachment 206853 [details]
Final patch

(In reply to Alexandros Perdikomatis from comment #25)

I have same error and this patch works for me!
Tested on FreeBSD 12.0 for virtualbox-ose-5.2.32_1.
May be commit in the ports tree?

root@vladiom:~ # uname -srm
FreeBSD 12.0-RELEASE-p10 amd64
root@vladiom:~ # 
root@vladiom:~ # pkg version -v | grep virtualbox
virtualbox-ose-5.2.32_1            =   up-to-date with index
virtualbox-ose-kmod-5.2.32_1       =   up-to-date with index

P.S.
Thanks all!

Comment 27 Kubilay Kocak 2019-08-26 04:50:27 UTC

*** Bug 240108 has been marked as a duplicate of this bug. ***

Comment 28 Kubilay Kocak 2019-08-26 05:23:11 UTC

For clarity and for this issue to progress, we need:

1) A complete (tested) failure/success matrix for at least each currently supported FreeBSD version, and CURRENT:

                  base | openssl | openssl111 | libressl | libressl-devel
FreeBSD 11.2
FreeBSD 12.0
FreeBSD CURRENT

Any patch provided needs to have QA confirmed (poudriere) against all ssl versions, that is, currently: base, openssl, openssl111, libressl, and libressl-devel

Confirmation should include verification that the rdesktop-vrdp module is linked against the chosen/expected SSl library (using ldd at least)

Builds fine with this change on 12.0amd64 with libressl.

(In reply to Walter Schwarzenfeld from comment #29)
Same with stable/12 and head. Should we close this PR and mark it as solved?

(In reply to Trond.Endrestol from comment #30)
For the record, ssl=base in the above case.

maintainer timeout

Recent versions of VBox have behavied themselves.