OmniSharp throws 'Crypto' exception on macOS 10.11 due openssl linking issue for .NET Core

[haakoo]

Environment data

dotnet --info output:

.NET Command Line Tools (1.0.0-preview2-003121)

Product Information:
Version: 1.0.0-preview2-003121
Commit SHA-1 hash: 1e9d529bc5

Runtime Environment:
OS Name: Mac OS X
OS Version: 10.11
OS Platform: Darwin
RID: osx.10.11-x64

VS Code version: Version 1.4.0 (1.4.0)

C# Extension version: 1.3.0

OpenSSL fix

I downloaded and installed .net core using the x64.pkg.
Because of the problem with OpenSSL (which sucks), I found a "correct" fix to get it working (https://github.com/dotnet/cli/issues/3964#issuecomment-236493536):

sudo install_name_tool -add_rpath /usr/local/opt/openssl/lib /usr/local/share/dotnet/shared/Microsoft.NETCore.App/1.0.0/System.Security.Cryptography.Native.dylib

After that I can use ´dotnet´command and I thought I was set.

Steps to reproduce

1. run ´dotnet new´
2. Open i VS Code

Expected behavior

Working intellisense

Actual behavior

No intellisense

OmniSharp Log:

[INFO] Starting OmniSharp at '/Users/haakoo/Development/omniTest'...
[INFO] Started OmniSharp from '/Users/haakoo/.vscode/extensions/ms-vscode.csharp-1.3.0/out/.omnisharp-coreclr/OmniSharp' with process id 3188...
OmniSharp: -s /Users/haakoo/Development/omniTest --hostPID 3176 DotNet:enablePackageRestore=false --stdio
[INFORMATION:OmniSharp.Startup] Omnisharp server running using Stdio at location '/Users/haakoo/Development/omniTest' on host 3176.
[INFORMATION:OmniSharp.DotNet.DotNetProjectSystem] Initializing in /Users/haakoo/Development/omniTest
[INFORMATION:OmniSharp.DotNet.DotNetProjectSystem] Auto package restore: False
[INFORMATION:OmniSharp.DotNet.DotNetProjectSystem] Update workspace context
[INFORMATION:OmniSharp.DotNet.DotNetProjectSystem] Update project /Users/haakoo/Development/omniTest
[INFORMATION:OmniSharp.DotNet.DotNetProjectSystem] Add project /Users/haakoo/Development/omniTest/project.json => cc4d7a84-5e0f-4961-b3c0-30e539a8be18
[INFORMATION:OmniSharp.DotNet.DotNetProjectSystem] Resolving projects references
[INFORMATION:OmniSharp.DotNet.DotNetProjectSystem] Processing [ProjectState] omniTest/.NETCoreApp,Version=v1.0
[INFORMATION:OmniSharp.DotNet.DotNetProjectSystem] Added 73 and removed 0 file references
[ERROR:OmniSharp.Startup] The project system 'DotNetProjectSystem' threw exception during initialization.
The type initializer for 'Crypto' threw an exception.
at Interop.Crypto.EvpSha1()
at Internal.Cryptography.HashProviderDispenser.CreateHashProvider(String hashAlgorithmId)
at System.Security.Cryptography.SHA1.Implementation..ctor()
at System.Security.Cryptography.SHA1.Create()
at Roslyn.Utilities.SHA1CryptoServiceProvider..ctor()
at Microsoft.CodeAnalysis.CryptographicHashProvider.TryGetAlgorithm(SourceHashAlgorithm algorithmId)
at Microsoft.CodeAnalysis.Text.SourceText.CalculateChecksum(Stream stream, SourceHashAlgorithm algorithmId)
at Microsoft.CodeAnalysis.Text.SourceText.From(Stream stream, Encoding encoding, SourceHashAlgorithm checksumAlgorithm, Boolean throwIfBinaryDetected)
at OmniSharp.DotNet.DotNetProjectSystem.UpdateSourceFiles(ProjectState state, IEnumerable1 sourceFiles) in /Users/travis/build/OmniSharp/omnisharp-roslyn/src/OmniSharp.DotNet/DotNetProjectSystem.cs:line 373 at OmniSharp.DotNet.DotNetProjectSystem.Update(Boolean allowRestore) in /Users/travis/build/OmniSharp/omnisharp-roslyn/src/OmniSharp.DotNet/DotNetProjectSystem.cs:line 129 at OmniSharp.Startup.Configure(IApplicationBuilder app, IServiceProvider serviceProvider, IOmnisharpEnvironment env, ILoggerFactory loggerFactory, ISharedTextWriter writer, IOmnisharpAssemblyLoader loader, IOptions1 optionsAccessor) in /Users/travis/build/OmniSharp/omnisharp-roslyn/src/OmniSharp.Host/Startup.cs:line 183
[INFORMATION:OmniSharp#MSBuild] No solution files found in '/Users/haakoo/Development/omniTest'
[INFORMATION:OmniSharp.Startup] Configuration finished.
[ERROR:Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware] An unhandled exception has occurred: A task was canceled.
[INFORMATION:OmniSharp.Middleware.LoggingMiddleware] /currentfilemembersastree: 500 629ms
[ERROR:Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware] An unhandled exception has occurred: A task was canceled.
[INFORMATION:OmniSharp.Middleware.LoggingMiddleware] /autocomplete: 500 312ms
[ERROR:Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware] An unhandled exception has occurred: A task was canceled.
[INFORMATION:OmniSharp.Middleware.LoggingMiddleware] /autocomplete: 500 14ms
[ERROR:Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware] An unhandled exception has occurred: A task was canceled.
[INFORMATION:OmniSharp.Middleware.LoggingMiddleware] /currentfilemembersastree: 500 7ms
[ERROR:Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware] An unhandled exception has occurred: A task was canceled.
[INFORMATION:OmniSharp.Middleware.LoggingMiddleware] /codecheck: 500 8ms
[ERROR:Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware] An unhandled exception has occurred: A task was canceled.
[INFORMATION:OmniSharp.Middleware.LoggingMiddleware] /codecheck: 500 10ms

[DustinCampbell]

Hi, unfortunately, the ugly "fix" you applied only works for the shared framework, which OmniSharp does not use (OmniSharp is fully self-contained). You should install and link openssl like so:

ln -s /usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib /usr/local/lib/
ln -s /usr/local/opt/openssl/lib/libssl.1.0.0.dylib /usr/local/lib/

[haakoo]

Ok. It's very confusing for me as a user when corefx have decided to move away from OpenSSL (https://github.com/dotnet/corefx/issues/9394), corecli recommend the rpath solution, so not to break things globably (https://github.com/dotnet/cli/issues/3964#issuecomment-236493536). And omnisharp recommends the solution that might break things globally.

Someone should figure out what's the best solution and actually do that. Instead users have to use two different "recommended" hacks.

[DustinCampbell]

I completely agree with you! 😄

@bartonjs, @ellism: do either of you have any thoughts here? Note that OmniSharp is a stand-alone .NET Core app. So, adding an rpath as suggested by (https://github.com/dotnet/cli/issues/3964#issuecomment-236493536) won't work, since it targets the shared framework.

[idchlife]

@DustinCampbell your solution, also mentioned at the official page of installing extension works!

[DustinCampbell]

Glad to hear it -- thanks @idchlife!

[MarlonRodriguez]

If you have MACPorts installed:
ln -s /opt/local/lib/libcrypto.1.0.0.dylib /usr/local/lib/
ln -s /opt/local/lib/libssl.1.0.0.dylib /usr/local/lib/

[DustinCampbell]

@haakoo: FWIW, if you want to fix this error without linking globally, you can do the following:

install_name_tool -add_rpath /usr/local/opt/openssl/lib ~/.vscode/extensions/ms-vscode.csharp-1.3.0/out/.omnisharp-coreclr/System.Security.Cryptography.Native.dylib

Note that the folder name is dependent on the version of the C# extension that have installed. So, if you update the C# extension, it'll have a new version (e.g. "ms-vscode.csharp-1.4.0") and would need to be linked again.

[haakoo]

@DustinCampbell I tried the install_name_tool solution after upgrading the plugin to day, and it worked. Is this something that can be added to the install-step for the plugin?

[DustinCampbell]

Possibly, although the instructions for .NET Core do specify making this change globally: https://www.microsoft.com/net/core#macos.

Long term, the plan is to just fix .NET Core to not use openssl on macOS.

[MarlonRodriguez]

Homebrew/brew#597 specifically lists core#macros as suggesting global linking but warns that it's a security risk. So the "install_name_tool" solution is better. Ignore this comment, it's wrong.

[gregg-miskelly]

@MarlonRodriguez folks who have spent many many hours thinking about this problem decided on the instructions on https://www.microsoft.com/net/core#macos. That solution avoids the security issue. So those are what we are going to go with for now. Though you are certainly welcome to use install_name_tool if you so desire.

[bartonjs]

@MarlonRodriguez The security risk comes from new libcrypto.dylib and libssl.dylib (the versionless uh... versions) being in /usr/local/lib/ (and the new headers being in /usr/local/include), because the compiler will use new-OpenSSL headers but the linker will still pull in the points-to-0.9.8 libcrypto.dylib from /usr/lib/ (compiler searches /usr/local/ first, linker searchers /usr/ first); which can set up misaligned calls.

In that thread with Homebrew there's the discussion about getting just the versioned assets linked in which they denied due to it being a niche feature, not due to it perpetuating the security problem.

[MarlonRodriguez]

@bartonjs thank you for the explanation. I was looking at another bug report on the powershell plugin for VSCode and went down a rabbit hole. I confess I didn't put enough time in to understand the reasoning and just looked at the sample "hack" without noticing the missing version numbers. My bad.

@gregg-miskelly I understand that and I certainly appreciate the help to get it working right. Notice that I did provide the same fix for MacPorts. I simply raised it as a warning since I saw the other bug. As @bartonjs explained my warning was misplaced and not valid for this fix.

Thank you both for taking the time to respond.

[perlun]

Thanks for this issue, helped me to work around this annoying behavior after upgrading to .NET Core 1.0.1.

$ sudo install_name_tool -add_rpath /usr/local/opt/openssl/lib /usr/local/share/dotnet/shared/Microsoft.NETCore.App/1.0.1/System.Security.Cryptography.Native.dylib

[gregg-miskelly]

As of 1.5, OmniSharp now runs on mono. So this is no longer an issue for OmniSharp (though it is for the debugger - see #779).