OpenWRT 22.03上Paramiko导入失败求助：ENGINE_ctrl_cmd_string符号缺失

在搭载MIPS架构的OpenWRT 22.03系统上使用Python 3.10，已安装所需依赖，但导入Paramiko时出现报错，核心问题是/usr/lib/python3.10/site-packages/cryptography/hazmat/bindings/_openssl.abi3.so文件找不到ENGINE_ctrl_cmd_string符号。

报错回溯 #

Python 3.10.9 (main, Sep 11 2023, 08:28:47) [GCC 11.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import paramiko
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/usr/lib/python3.10/site-packages/paramiko/__init__.py", line 22, in <module>
from paramiko.transport import SecurityOptions, Transport
File "/usr/lib/python3.10/site-packages/paramiko/transport.py", line 135, in <module>
class Transport(threading.Thread, ClosingContextManager):
File "/usr/lib/python3.10/site-packages/paramiko/transport.py", line 209, in Transport
if KexCurve25519.is_available():
File "/usr/lib/python3.10/site-packages/paramiko/kex_curve25519.py", line 30, in is_available
X25519PrivateKey.generate()
File "/usr/lib/python3.10/site-packages/cryptography/hazmat/primitives/asymmetric/x25519.py", line 39, in generate
from cryptography.hazmat.backends.openssl.backend import backend
File "/usr/lib/python3.10/site-packages/cryptography/hazmat/backends/openssl/__init__.py", line 6, in <module>
from cryptography.hazmat.backends.openssl.backend import backend
File "/usr/lib/python3.10/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 113, in <module>
from cryptography.hazmat.bindings.openssl import binding
File "/usr/lib/python3.10/site-packages/cryptography/hazmat/bindings/openssl/binding.py", line 14, in <module>
from cryptography.hazmat.bindings._openssl import ffi, lib
ImportError: Error relocating /usr/lib/python3.10/site-packages/cryptography/hazmat/bindings/_openssl.abi3.so: ENGINE_ctrl_cmd_string: symbol not found

已安装依赖列表 #

Package      Version
------------ -------
bcrypt       3.2.2
bottle       0.12.19
cffi         1.16.0
cryptography 3.4.8
hanip        2.11
ifaddr       0.1.7
netifaces    0.10.9
paho-mqtt    1.6.1
paramiko     3.0.0
pip          23.0.1
ply          3.11
pycparser    2.21
PyNaCl       1.5.0
pyOpenSSL    24.0.0
pyserial     3.4
setuptools   65.5.0
six          1.16.0
xmltodict    0.12.0
zeroconf     0.21.3

解决思路 #

• 检查OpenSSL版本与符号存在性：执行openssl version查看系统OpenSSL版本，cryptography 3.4.8要求版本至少为1.1.0；再执行nm -D /usr/lib/libssl.so | grep ENGINE_ctrl_cmd_string，确认系统OpenSSL库是否包含目标符号。若版本过低或符号缺失，需升级或替换带ENGINE模块支持的OpenSSL。
• 源码编译cryptography：pip预编译包可能不兼容MIPS架构，先卸载现有版本：pip uninstall -y cryptography，安装OpenWRT编译依赖（如openssl-dev、python3-dev、gcc），再从源码编译安装：pip install cryptography==3.4.8 --no-binary :all:。
• 降级Paramiko版本：Paramiko 3.0.0对依赖要求较高，尝试降级到2.x兼容版本：pip uninstall -y paramiko && pip install paramiko==2.12.0。
• 替换系统OpenSSL库：若系统OpenSSL确实缺失目标符号，可重新编译启用ENGINE模块的OpenSSL，或从OpenWRT软件源安装完整功能的OpenSSL包。

内容的提问来源于stack exchange，提问作者Cooper