Unable to start rabbitmq 3.7.4 on SUSE Linux enterprose Server 12 SP3

[Aniket Patil]

I am using rabbitmq-3.74 and erlang 19.3 on the following linux machine. 

NAME="SLES"

VERSION="12-SP3"

VERSION_ID="12.3"

PRETTY_NAME="SUSE Linux Enterprise Server 12 SP3"

ID="sles"

ANSI_COLOR="0;32"

CPE_NAME="cpe:/o:suse:sles:12:sp3"

I am unable to start rabbtimq with the following configuration 

listeners.ssl.default                   = 27271

ssl_options.verify                      = verify_none

ssl_options.fail_if_no_peer_cert        = false

ssl_options.cacertfile                  = /home/ags/arcgis/server//framework/runtime/rabbitmq/ssl/cacert.pem

ssl_options.certfile                    = /home/ags/arcgis/server//framework/runtime/rabbitmq/ssl/cert.pem

ssl_options.keyfile                     = /home/ags/arcgis/server//framework/runtime/rabbitmq/ssl/key.pem

I get the following erlang crash 

{"Kernel pid terminated",application_controller,"{application_start_failure,rabbit,{bad_return,{{rabbit,start,[normal,[]]},{'EXIT',{undef,[{crypto,supports,[],[]},{tls_record,supported_protocol_versions,1,[{file,\"tls_record.erl\"},{line,401}]},{tls_record,supported_protocol_versions,0,[{file,\"tls_record.erl\"},{line,247}]},{ssl,versions,0,[{file,\"ssl.erl\"},{line,577}]},{rabbit_ssl_options,fix_ssl_protocol_versions,1,[{file,\"src/rabbit_ssl_options.erl\"},{line,87}]},{rabbit_ssl_options,fix,1,[{file,\"src/rabbit_ssl_options.erl\"},{line,27}]},{rabbit_networking,boot_ssl,1,[{file,\"src/rabbit_networking.erl\"},{line,136}]},{rabbit_networking,boot,0,[{file,\"src/rabbit_networking.erl\"},{line,122}]}]}}}}}"}

Kernel pid terminated (application_controller) ({application_start_failure,rabbit,{bad_return,{{rabbit,start,[normal,[]]},{'EXIT',{undef,[{crypto,supports,[],[]},{tls_record,supported_protocol_version

and have the following in rabbitmq logs 

2018-05-09 17:20:05.941 [warning] <0.318.0> The on_load function for module crypto returned {error,{load_failed,"Failed to load NIF library: '/home/gep/arcgis/server/framework/runtime/rabbitmq/erlang/lib/crypto-3.7.3/priv/lib/crypto.so: symbol EC_GROUP_new_curve_GF2m, version OPENSSL_1.0.0 not defined in file libcrypto.so.1.0.0 with link time reference'"}}

2018-05-09 17:20:05.955 [error] <0.319.0> Unable to load crypto library. Failed with error:

"load_failed, Failed to load NIF library: '/home/gep/arcgis/server/framework/runtime/rabbitmq/erlang/lib/crypto-3.7.3/priv/lib/crypto.so: symbol EC_GROUP_new_curve_GF2m, version OPENSSL_1.0.0 not defined in file libcrypto.so.1.0.0 with link time reference'"

OpenSSL might not be installed on this system.

2018-05-09 17:20:05.957 [warning] <0.320.0> The on_load function for module crypto returned {error,{load_failed,"Failed to load NIF library: '/home/gep/arcgis/server/framework/runtime/rabbitmq/erlang/lib/crypto-3.7.3/priv/lib/crypto.so: symbol EC_GROUP_new_curve_GF2m, version OPENSSL_1.0.0 not defined in file libcrypto.so.1.0.0 with link time reference'"}}

I have open-ssl installed on the system. 

ags@Dev0003236:~/arcgis/server/framework/runtime/rabbitmq/sbin> rpm -qa | grep openssl

openssl-1.0.2j-59.1.x86_64

libopenssl1_0_0-32bit-1.0.2j-59.1.x86_64

libopenssl1_0_0-1.0.2j-59.1.x86_64

libopenssl-devel-1.0.2j-59.1.x86_64

Can some one please help me understand what can be the issue. I am attaching the erlang crash dump and rabbitmq logs

Thanks,
Aniket

[Michael Klishin]

Your Erlang/OTP installation is missing crypto/TLS modules, which are required by RabbitMQ.

--
You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-users+unsubscribe@googlegroups.com.
To post to this group, send email to rabbitmq-users@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

MK

Staff Software Engineer, Pivotal/RabbitMQ

[Michael Klishin]

Relevant doc section: http://www.rabbitmq.com/ssl.html#erlang-otp-requirements.

To post to this group, send email to rabbitm...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

MK

Staff Software Engineer, Pivotal/RabbitMQ

[Aniket Patil]

Thanks Micheal. 

 I can see that libopenssl-devel is installed on that machine.

ags@Dev0003236:~/arcgis/server/framework/runtime/rabbitmq/sbin> sudo  zypper  install libopenssl-devel

Loading repository data...

Reading installed packages...

'libopenssl-devel' is already installed.

No update candidate for 'libopenssl-devel-1.0.2j-59.1.x86_64'. The highest available version is already installed.

Resolving package dependencies...

Is there any other modules i am missing. This same rabbitmq and erlang works fine on Ubuntu and RHEL linux machines.

Thanks,
Aniket

[Michael Klishin]

Note I did not say that your machine is missing OpenSSL but that the Erlang/OTP installation is missing

crypto and TLS modules. If Erlang was compiled from source that likely means the ./configure script was no instructed

to compile them or the script couldn't find the OpenSSL library/headers.

--
You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-users+unsubscribe@googlegroups.com.

To post to this group, send email to rabbitmq-users@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Aniket Patil]

Also open ssl is installed. 

ags@Dev0003236:~/arcgis/server/framework/runtime/rabbitmq/sbin> sudo zypper install  openssl

Loading repository data...

Reading installed packages...

'openssl' is already installed.

No update candidate for 'openssl-1.0.2j-59.1.x86_64'. The highest available version is already installed.

Resolving package dependencies...

Nothing to do.

ags@Dev0003236:~/arcgis/server/framework/runtime/rabbitmq/sbin>

On Wednesday, May 9, 2018 at 6:00:13 PM UTC-7, Aniket Patil wrote:

[Michael Klishin]

I'm sorry but Erlang on SUSE and Erlang on Ubuntu are not the same. Different distributions package Erlang (and pretty much any other runtime)

differently. On Ubuntu the distribution is split into dozens of package and to get TLS and crypto modules you need to install

one of them, listed in the docs.

I don't use SUSE so I don't really know how things are packaged there but very likely there's an Erlang package that can be installed,

similarly to Debian/Ubuntu.

A quick google search revealed https://packagehub.suse.com/packages/erlang/. I don't see any subpackages with "ssl" in the name and the version

provided there is old (18.x). I could find https://build.opensuse.org/package/show/openSUSE%3ABackports%3ASLE-15/erlang that also makes no

mention of TLS or crypto but at least it's the version we recommend.

To post to this group, send email to rabbitm...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

MK

Staff Software Engineer, Pivotal/RabbitMQ

[Michael Klishin]

Aniket,

Please understand that Erlang/OTP, the runtime that RabbitMQ requires, has its own TLS and crypto modules

(that depend on OpenSSL for crypto functions) that must be built and distributed in order for RabbitMQ to work.

Your installation is missing those modules, so some modules/functions RabbitMQ assumes to be available are not.

Having OpenSSL is necessary but not sufficient.

--
You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-users+unsubscribe@googlegroups.com.

To post to this group, send email to rabbitmq-users@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Aniket Patil]

Hi Micheal,

Thanks for your inputs. I appreciate your help.  Yes i did compile erlang 19.3 from source with OpenSSL. I included it in rabbitmq distribution.  However the same compiled erlang with rabbitmq works on ubuntu and RHEL linux machines with TLS configurations. 

Its only give me issues on a SUSE linux machines. What can i check to see why rabbitmq cannot find TLS cryto modules as the same rabbitmq with erlang works fine on Ubuntu and RHEL linux with TLS config. 

Thanks,
Aniket

On Wednesday, May 9, 2018 at 6:00:13 PM UTC-7, Aniket Patil wrote:

[Michael Klishin]

Run `erl` and then

crypto:start().

(with a trailing dot) and hit Enter. If your Erlang/OTP installation includes crypto modules

you should see

> ok

otherwise there will be an exception.

How to compile Erlang from source on SUSE with TLS support is a bit outside of the scope of this list.

Please consult Erlang documentation [1] and ask on erlang-questions.

Or consider building with kerl [2] and using configure flags that look something like this:

export KERL_CONFIGURE_OPTIONS="--with-ssl=/path/to/local/openssl --without-javac --enable-shared-zlib --enable-dynamic-ssl-lib --enable-hipe --enable-smp-support --enable-threads --enable-kernel-poll"

1. http://erlang.org/doc/installation_guide/INSTALL.html

2. https://github.com/kerl/kerl

--
You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-users+unsubscribe@googlegroups.com.
To post to this group, send email to rabbitmq-users@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Aniket Patil]

Thanks Micheal. As expected the erlang cypto test fails 

ags@Dev0003236:~/arcgis/server/framework/runtime/rabbitmq/erlang/bin> ./erl

/home/ags/arcgis/server/framework/runtime/rabbitmq/erlang/erts-8.3/bin/beam.smp: /lib64/libtinfo.so.5: no version information available (required by /home/ags/arcgis/server/framework/runtime/rabbitmq/erlang/erts-8.3/bin/beam.smp)

Erlang/OTP 19 [erts-8.3] [source] [64-bit] [smp:4:4] [async-threads:10] [kernel-poll:false]

Eshell V8.3  (abort with ^G)

1> crypto.start().

* 1: syntax error before: '.'

1> crypto:start().

** exception error: undefined function crypto:start/0

2>

=ERROR REPORT==== 9-May-2018::19:44:51 ===

Unable to load crypto library. Failed with error:

"load_failed, Failed to load NIF library: '/home/ags/arcgis/server/framework/runtime/rabbitmq/erlang/lib/crypto-3.7.3/priv/lib/crypto.so: symbol EC_GROUP_new_curve_GF2m, version OPENSSL_1.0.0 not defined in file libcrypto.so.1.0.0 with link time reference'"

OpenSSL might not be installed on this system.

 

=WARNING REPORT==== 9-May-2018::19:44:51 ===

The on_load function for module crypto returned {error,

 {load_failed,"Failed to load NIF library: '/home/ags/arcgis/server/framework/runtime/rabbitmq/erlang/lib/crypto-3.7.3/priv/lib/crypto.so: symbol EC_GROUP_new_curve_GF2m, version OPENSSL_1.0.0 not defined in file libcrypto.so.1.0.0 with link time reference'"}}

On Wednesday, May 9, 2018 at 6:00:13 PM UTC-7, Aniket Patil wrote:

[Michael Klishin]

Your local OpenSSL version likely doesn't match what the code was compiled against.

Make sure to build on the machine you are going to run it on, not build on one (e.g. Ubuntu) and copy to both.

https://www.ejabberd.im/node/24889/index.html is one thread that mentions that exact message.

This is erlang-questions material at this point.

--
You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-users+unsubscribe@googlegroups.com.
To post to this group, send email to rabbitmq-users@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Aniket Patil]

I was using an erlang build on ubuntu on SUSE machine. I was able to resolve this issue by building the erlang on a SUSE machine.

Thanks Micheal for all your inputs. You are always very helpful and I appreciate it.

On Wednesday, May 9, 2018 at 6:00:13 PM UTC-7, Aniket Patil wrote: