Fix broken ./configure on systems without openssl.pc

PATCH Superseded David Sommerseth 4 participants 18 messages Apr 13, 2017 – Apr 25, 2017

Share & tools

David Sommerseth

author

2017-04-13 17:26 UTC #0 lore raw

PATCH 1/1 Fix broken ./configure on systems without openssl.pc

Commit 039a89c331e9b799 changed the OpenSSL check slightly, but that broke ./configure on systems which do not install the openssl.pc pkg-config support file. This is typically an issue on most of the BSD platforms, where the OpenSSL package from the base repository does not provide that file.

We should anyway in this case have a better check of OpenSSL version available. So in the case pkg-config fails, it will run an additional test looking for the OpenSSL version number in the opensslv.h header file and check against that version number.

I did consider to rip out the pkg-config test all together, but decided to let it stay. If pkg-config works, it provides much more details to the ./configure script than just the version number check - such as include and library paths if those are outside the default system paths.

If the user adds OPENSSL_CFLAGS or OPENSSL_LIBS to the ./configure script, the pkg-config will not be run. But this patch ensures that the OpenSSL version is also checked in this situation.

This patch have been tested on Scientic Linux 7.3 (RHEL clone) and FreeBSD 10.3-RELEASE-p11.

Signed-off-by David Sommerseth <[email protected]...>

---
 configure.ac | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

configure.ac +23 -1

index acea060..ffffcc6 100644
@@ -861,12 +861,34 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 			[OPENSSL],
 			[libcrypto >= 1.0.1, libssl >= 1.0.1],
 	                [have_openssl="yes"],
-			[AC_MSG_ERROR([Minimum supported OpenSSL version is 1.0.1])]
+			[] # If this fails, we will do another test next
 		)
 
 		OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
 	fi
 
+        # If pkgconfig check failed, add an additional version check
+        if test "${have_openssl}" != "yes"; then
+           AC_MSG_CHECKING([additionally if OpenSSL is available and version >= 1.0.1])
+	   AC_COMPILE_IFELSE(
+		[AC_LANG_PROGRAM(
+			[[
+#include <openssl/opensslv.h>
+			]],
+			[[
+/* Strip out some of the version information we don't care about */
+#define OSSLVER OPENSSL_VERSION_NUMBER >> 12
+#if OSSLVER < 0x10001
+#error OpneSSL too old
+#endif
+			]]
+		)],
+		[AC_MSG_RESULT([ok])],
+		[AC_MSG_ERROR([OpenSSL version too old])]
+	   )
+           OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
+        fi
+
 	saved_CFLAGS="${CFLAGS}"
 	saved_LIBS="${LIBS}"
 	CFLAGS="${CFLAGS} ${OPENSSL_CFLAGS}"

Signature · 1 line

2.11.0

Gert Doering

2017-04-15 09:16 UTC #1 lore raw

Hi,

configure.ac if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then · line 883

Quoted 5 lines · David Sommerseth

configure.ac +5 -0

+/* Strip out some of the version information we don't care about */
+#define OSSLVER OPENSSL_VERSION_NUMBER >> 12
+#if OSSLVER < 0x10001
+#error OpneSSL too old
+#endif

While this works (except for the typo) - why not just do full-length math, as in

#if OPENSSL_VERSION_NUMBER < 0x10001000L
#error OpneSSL too old
#endif

(note the L prefix, as in the opensslv.h #define)

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

David Sommerseth

2017-04-15 09:42 UTC #2 lore raw

Quoted 12 lines · Gert Doering

Hi,
configure.ac if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then · line 883
Quoted 5 lines · David Sommerseth
configure.ac +5 -0
+/* Strip out some of the version information we don't care about */
+#define OSSLVER OPENSSL_VERSION_NUMBER >> 12
+#if OSSLVER < 0x10001
+#error OpneSSL too old
+#endif
While this works (except for the typo) - why not just do full-length math, as in

Quoted 5 lines

#if OPENSSL_VERSION_NUMBER < 0x10001000L
#error OpneSSL too old
#endif
(note the L prefix, as in the opensslv.h #define)

Basically it was just to make the matching more similar to the matching we do with pkg-config, which does not care for the letter in the version.

The OPENSSL_VERSION_NUMBER is also fairly complex, and also provides "flags" if it is a beta releases or final releases too. So by stripping out the LSB 12 bits, the whole check gets a bit more "understandable" without having to understand the whole version formatting.

What is also a bit confusing to me, is that they version spec they have documented, says the last nibble (4 bits) is the status flag (dev, beta or release). While it seems to be encoded as a byte. So the shift operation considers 4 bits and not 8 bits. The next 8 next bits is the "letter" in version string. Hence the shift is 12 bits.

So reviewing this now, this 12 bit shift may actually fail on big endian machines. It would probably be better to do a full 16 bit shift.

But if we don't want to reduce the match set to only version numbers, I'm fine with skipping the shifts all together.

Signature · 4 lines

kind regards,

David Sommerseth
OpenVPN Technologies, Inc

Gert Doering

2017-04-15 12:34 UTC #3 lore raw

Hi,

Quoted 5 lines · David Sommerseth

So reviewing this now, this 12 bit shift may actually fail on big endian machines. It would probably be better to do a full 16 bit shift.
But if we don't want to reduce the match set to only version numbers, I'm fine with skipping the shifts all together.

Since this is a nice number, comparing with "<" or ">" will just ignore those lower bits anyway.

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

David Sommerseth

author

2017-04-17 09:01 UTC #4 lore raw

PATCH v2 1/1 Fix broken ./configure on systems without openssl.pc

In reply to David Sommerseth

If the user adds OPENSSL_CFLAGS or OPENSSL_LIBS to the ./configure script, the pkg-config will not be run. But this patch ensures that the OpenSSL version is also checked in this situation.

This patch have been tested on Scientic Linux 7.3 (RHEL clone) and FreeBSD 10.3-RELEASE-p11.

v2 - Don't use try to simplify the version matching, use the full
OPENSSL_VERSION_NUMBER
- Fixed typo (OpneSSL -> OpenSSL)
- Improve a few comments

Signed-off-by David Sommerseth <[email protected]...>

---
 configure.ac | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

configure.ac +23 -1

index acea060..cdd7847 100644
@@ -861,12 +861,34 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 			[OPENSSL],
 			[libcrypto >= 1.0.1, libssl >= 1.0.1],
 	                [have_openssl="yes"],
-			[AC_MSG_ERROR([Minimum supported OpenSSL version is 1.0.1])]
+			[] # If this fails, we will do another test next
 		)
 
 		OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
 	fi
 
+        # If pkgconfig check failed or OPENSSL_CFLAGS/OPENSSL_LIBS env vars
+        # are used, check the version directly in the OpenSSL include file
+        if test "${have_openssl}" != "yes"; then
+           AC_MSG_CHECKING([additionally if OpenSSL is available and version >= 1.0.1])
+	   AC_COMPILE_IFELSE(
+		[AC_LANG_PROGRAM(
+			[[
+#include <openssl/opensslv.h>
+			]],
+			[[
+/*           Version encoding: MNNFFPPS - see opensslv.h for details */
+#if OPENSSL_VERSION_NUMBER < 0x10001000L
+#error OpenSSL too old
+#endif
+			]]
+		)],
+		[AC_MSG_RESULT([ok])],
+		[AC_MSG_ERROR([OpenSSL version too old])]
+	   )
+           OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
+        fi
+
 	saved_CFLAGS="${CFLAGS}"
 	saved_LIBS="${LIBS}"
 	CFLAGS="${CFLAGS} ${OPENSSL_CFLAGS}"

Signature · 1 line

2.11.0

Steffan Karger

2017-04-17 20:36 UTC #5 lore raw

Hi,

Quoted 6 lines · David Sommerseth

[..]
We should anyway in this case have a better check of OpenSSL version available. So in the case pkg-config fails, it will run an additional test looking for the OpenSSL version number in the opensslv.h header file and check against that version number.

Content-wise this looks good, but two remarks:

configure.ac if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then · line 868

Quoted 10 lines

configure.ac +1 -1

@@ -861,12 +861,34 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 			[OPENSSL],
 			[libcrypto >= 1.0.1, libssl >= 1.0.1],
 	                [have_openssl="yes"],
-			[AC_MSG_ERROR([Minimum supported OpenSSL version is 1.0.1])]
+			[] # If this fails, we will do another test next
 		)
 
 		OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
 	fi

I think this OPENSSL_LIBS default can go now, since it is set below if needed.

Quoted 11 lines

configure.ac +11 -0

+        # If pkgconfig check failed or OPENSSL_CFLAGS/OPENSSL_LIBS env vars
+        # are used, check the version directly in the OpenSSL include file
+        if test "${have_openssl}" != "yes"; then
+           AC_MSG_CHECKING([additionally if OpenSSL is available and version >= 1.0.1])
+	   AC_COMPILE_IFELSE(
+		[AC_LANG_PROGRAM(
+			[[
+#include <openssl/opensslv.h>
+			]],
+			[[
+/*           Version encoding: MNNFFPPS - see opensslv.h for details */

configure.ac if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then · line 890

Quoted 10 lines

configure.ac +10 -0

+#if OPENSSL_VERSION_NUMBER < 0x10001000L
+#error OpenSSL too old
+#endif
+			]]
+		)],
+		[AC_MSG_RESULT([ok])],
+		[AC_MSG_ERROR([OpenSSL version too old])]
+	   )
+           OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
+        fi

Tabs and spaces are mixed here. The surrounding lines seem to be tabs-only. (This bites me each time I edit configure.ac too...)

-Steffan

David Sommerseth

2017-04-17 20:58 UTC #6 lore raw

Quoted 19 lines · Steffan Karger

Hi,
Quoted 6 lines · David Sommerseth
[..]
We should anyway in this case have a better check of OpenSSL version available. So in the case pkg-config fails, it will run an additional test looking for the OpenSSL version number in the opensslv.h header file and check against that version number.
Content-wise this looks good, but two remarks:
Quoted 8 lines
configure.ac +1 -1
@@ -861,12 +861,34 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 			[OPENSSL],
 			[libcrypto >= 1.0.1, libssl >= 1.0.1],
 	                [have_openssl="yes"],
-			[AC_MSG_ERROR([Minimum supported OpenSSL version is 1.0.1])]
+			[] # If this fails, we will do another test next
 		)
 

Quoted 5 lines

configure.ac if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then · line 868
Quoted 2 lines
configure.ac +0 -0
 		OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
 	fi
I think this OPENSSL_LIBS default can go now, since it is set below if needed.

Ah, right. Somehow I connected that to pkg-config as well. But you're right!

Quoted 16 lines

configure.ac +16 -0

+        # If pkgconfig check failed or OPENSSL_CFLAGS/OPENSSL_LIBS env vars
+        # are used, check the version directly in the OpenSSL include file
+        if test "${have_openssl}" != "yes"; then
+           AC_MSG_CHECKING([additionally if OpenSSL is available and version >= 1.0.1])
+	   AC_COMPILE_IFELSE(
+		[AC_LANG_PROGRAM(
+			[[
+#include <openssl/opensslv.h>
+			]],
+			[[
+/*           Version encoding: MNNFFPPS - see opensslv.h for details */
+#if OPENSSL_VERSION_NUMBER < 0x10001000L
+#error OpenSSL too old
+#endif
+			]]
+		)],

Quoted 8 lines

configure.ac if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then · line 890
Quoted 5 lines
configure.ac +5 -0
+		[AC_MSG_RESULT([ok])],
+		[AC_MSG_ERROR([OpenSSL version too old])]
+	   )
+           OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
+        fi
Tabs and spaces are mixed here. The surrounding lines seem to be tabs-only. (This bites me each time I edit configure.ac too...)

Oh bloody h...... *grmbl* .... Something have seriously changed in my emacs setup during an update or something related; I've never had as much tab/space mess as I've had lately. It used to do everything correct earlier.

I'll send another update soonish. Thanks!

Signature · 4 lines

kind regards,

David Sommerseth
OpenVPN Technologies, Inc

David Sommerseth

author

2017-04-17 23:28 UTC #7 lore raw

PATCH v3 1/1 Fix broken ./configure on systems without openssl.pc

In reply to David Sommerseth

If the user adds OPENSSL_CFLAGS or OPENSSL_LIBS to the ./configure script, the pkg-config will not be run. But this patch ensures that the OpenSSL version is also checked in this situation.

This patch have been tested on Scientic Linux 7.3 (RHEL clone) and FreeBSD 10.3-RELEASE-p11.

v3 - Remove not needed and duplicated OPENSSL_LIBS assignment
- Fix tab/space issues in modified lines

v2 - Don't use try to simplify the version matching, use the full
OPENSSL_VERSION_NUMBER
- Fixed typo (OpneSSL -> OpenSSL)
- Improve a few comments

Signed-off-by David Sommerseth <[email protected]...>

---
 configure.ac | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

configure.ac +23 -3

index acea060..a0cbc98 100644
@@ -860,11 +860,31 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 		PKG_CHECK_MODULES(
 			[OPENSSL],
 			[libcrypto >= 1.0.1, libssl >= 1.0.1],
-	                [have_openssl="yes"],
-			[AC_MSG_ERROR([Minimum supported OpenSSL version is 1.0.1])]
+			[have_openssl="yes"],
+			[] # If this fails, we will do another test next
 		)
+	fi
 
-		OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
+	# If pkgconfig check failed or OPENSSL_CFLAGS/OPENSSL_LIBS env vars
+	# are used, check the version directly in the OpenSSL include file
+	if test "${have_openssl}" != "yes"; then
+	   AC_MSG_CHECKING([additionally if OpenSSL is available and version >= 1.0.1])
+	   AC_COMPILE_IFELSE(
+		[AC_LANG_PROGRAM(
+			[[
+#include <openssl/opensslv.h>
+			]],
+			[[
+/*	     Version encoding: MNNFFPPS - see opensslv.h for details */
+#if OPENSSL_VERSION_NUMBER < 0x10001000L
+#error OpenSSL too old
+#endif
+			]]
+		)],
+		[AC_MSG_RESULT([ok])],
+		[AC_MSG_ERROR([OpenSSL version too old])]
+	   )
+	   OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
 	fi
 
 	saved_CFLAGS="${CFLAGS}"

Signature · 1 line

2.11.0

Steffan Karger

2017-04-20 22:06 UTC #8 lore raw

Hi,

Quoted 66 lines · David Sommerseth

Commit 039a89c331e9b799 changed the OpenSSL check slightly, but that broke ./configure on systems which do not install the openssl.pc pkg-config support file. This is typically an issue on most of the BSD platforms, where the OpenSSL package from the base repository does not provide that file.
We should anyway in this case have a better check of OpenSSL version available. So in the case pkg-config fails, it will run an additional test looking for the OpenSSL version number in the opensslv.h header file and check against that version number.
I did consider to rip out the pkg-config test all together, but decided to let it stay. If pkg-config works, it provides much more details to the ./configure script than just the version number check - such as include and library paths if those are outside the default system paths.
If the user adds OPENSSL_CFLAGS or OPENSSL_LIBS to the ./configure script, the pkg-config will not be run. But this patch ensures that the OpenSSL version is also checked in this situation.
This patch have been tested on Scientic Linux 7.3 (RHEL clone) and FreeBSD 10.3-RELEASE-p11.
v3 - Remove not needed and duplicated OPENSSL_LIBS assignment
- Fix tab/space issues in modified lines
v2 - Don't use try to simplify the version matching, use the full
OPENSSL_VERSION_NUMBER
- Fixed typo (OpneSSL -> OpenSSL)
- Improve a few comments
Signed-off-by David Sommerseth <[email protected]...>
---
 configure.ac | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)
configure.ac +16 -3
index acea060..a0cbc98 100644
@@ -860,11 +860,31 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 		PKG_CHECK_MODULES(
 			[OPENSSL],
 			[libcrypto >= 1.0.1, libssl >= 1.0.1],
-	                [have_openssl="yes"],
-			[AC_MSG_ERROR([Minimum supported OpenSSL version is 1.0.1])]
+			[have_openssl="yes"],
+			[] # If this fails, we will do another test next
 		)
+	fi
 
-		OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
+	# If pkgconfig check failed or OPENSSL_CFLAGS/OPENSSL_LIBS env vars
+	# are used, check the version directly in the OpenSSL include file
+	if test "${have_openssl}" != "yes"; then
+	   AC_MSG_CHECKING([additionally if OpenSSL is available and version >= 1.0.1])
+	   AC_COMPILE_IFELSE(
+		[AC_LANG_PROGRAM(
+			[[
+#include <openssl/opensslv.h>
+			]],
+			[[
+/*	     Version encoding: MNNFFPPS - see opensslv.h for details */
+#if OPENSSL_VERSION_NUMBER < 0x10001000L
+#error OpenSSL too old

configure.ac if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then · line 890

Quoted 10 lines

configure.ac +7 -0

+#endif
+			]]
+		)],
+		[AC_MSG_RESULT([ok])],
+		[AC_MSG_ERROR([OpenSSL version too old])]
+	   )
+	   OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
 	fi
 
 	saved_CFLAGS="${CFLAGS}"

Sorry I didn't spot this before, but the new check should come after the lines that update the CFLAGS and LIBS, otherwise this checks the system lib, rather than the one specified though OPENSSL_LIBS and OPENSSL_CFLAGS. (The first line of that is the last line of this patch.)

And still some spaces in there ;-)

-Steffan

David Sommerseth

author

2017-04-21 22:07 UTC #9 lore raw

PATCH v4 1/1 Fix broken ./configure on systems without openssl.pc

In reply to David Sommerseth

If the user adds OPENSSL_CFLAGS or OPENSSL_LIBS to the ./configure script, the pkg-config will not be run. But this patch ensures that the OpenSSL version is also checked in this situation.

This patch have been tested on Scientic Linux 7.3 (RHEL clone) and FreeBSD 10.3-RELEASE-p11.

v4 - Move the CFLAGS/LDFLAGS declarations before the manual
version test; otherwise we're still testing the system install version

v3 - Remove not needed and duplicated OPENSSL_LIBS assignment
- Fix tab/space issues in modified lines

v2 - Don't use try to simplify the version matching, use the full
OPENSSL_VERSION_NUMBER
- Fixed typo (OpneSSL -> OpenSSL)
- Improve a few comments

Signed-off-by David Sommerseth <[email protected]...>

---
 configure.ac | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

configure.ac +24 -4

index acea060..2b98375 100644
@@ -860,11 +860,9 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 		PKG_CHECK_MODULES(
 			[OPENSSL],
 			[libcrypto >= 1.0.1, libssl >= 1.0.1],
-	                [have_openssl="yes"],
-			[AC_MSG_ERROR([Minimum supported OpenSSL version is 1.0.1])]
+			[have_openssl="yes"],
+			[] # If this fails, we will do another test next
 		)
-
-		OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
 	fi
 
 	saved_CFLAGS="${CFLAGS}"

@@ -872,6 +870,28 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 	CFLAGS="${CFLAGS} ${OPENSSL_CFLAGS}"
 	LIBS="${LIBS} ${OPENSSL_LIBS}"
 
+	# If pkgconfig check failed or OPENSSL_CFLAGS/OPENSSL_LIBS env vars
+	# are used, check the version directly in the OpenSSL include file
+	if test "${have_openssl}" != "yes"; then
+	   AC_MSG_CHECKING([additionally if OpenSSL is available and version >= 1.0.1])
+	   AC_COMPILE_IFELSE(
+		[AC_LANG_PROGRAM(
+			[[
+#include <openssl/opensslv.h>
+			]],
+			[[
+/*	     Version encoding: MNNFFPPS - see opensslv.h for details */
+#if OPENSSL_VERSION_NUMBER < 0x10001000L
+#error OpenSSL too old
+#endif
+			]]
+		)],
+		[AC_MSG_RESULT([ok])],
+		[AC_MSG_ERROR([OpenSSL version too old])]
+	   )
+	   OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
+	fi
+
 	AC_CHECK_FUNCS([SSL_CTX_new EVP_CIPHER_CTX_set_key_length],
 				   ,
 				   [AC_MSG_ERROR([openssl check failed])]

Signature · 1 line

2.11.0

Steffan Karger

2017-04-22 06:28 UTC #10 lore raw

Hi,

Quoted 78 lines · David Sommerseth

Commit 039a89c331e9b799 changed the OpenSSL check slightly, but that broke ./configure on systems which do not install the openssl.pc pkg-config support file. This is typically an issue on most of the BSD platforms, where the OpenSSL package from the base repository does not provide that file.
We should anyway in this case have a better check of OpenSSL version available. So in the case pkg-config fails, it will run an additional test looking for the OpenSSL version number in the opensslv.h header file and check against that version number.
I did consider to rip out the pkg-config test all together, but decided to let it stay. If pkg-config works, it provides much more details to the ./configure script than just the version number check - such as include and library paths if those are outside the default system paths.
If the user adds OPENSSL_CFLAGS or OPENSSL_LIBS to the ./configure script, the pkg-config will not be run. But this patch ensures that the OpenSSL version is also checked in this situation.
This patch have been tested on Scientic Linux 7.3 (RHEL clone) and FreeBSD 10.3-RELEASE-p11.
v4 - Move the CFLAGS/LDFLAGS declarations before the manual
version test; otherwise we're still testing the system install version
v3 - Remove not needed and duplicated OPENSSL_LIBS assignment
- Fix tab/space issues in modified lines
v2 - Don't use try to simplify the version matching, use the full
OPENSSL_VERSION_NUMBER
- Fixed typo (OpneSSL -> OpenSSL)
- Improve a few comments
Signed-off-by David Sommerseth <[email protected]...>
---
 configure.ac | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)
configure.ac +17 -4
index acea060..2b98375 100644
@@ -860,11 +860,9 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 		PKG_CHECK_MODULES(
 			[OPENSSL],
 			[libcrypto >= 1.0.1, libssl >= 1.0.1],
-	                [have_openssl="yes"],
-			[AC_MSG_ERROR([Minimum supported OpenSSL version is 1.0.1])]
+			[have_openssl="yes"],
+			[] # If this fails, we will do another test next
 		)
-
-		OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
 	fi
 
 	saved_CFLAGS="${CFLAGS}"
@@ -872,6 +870,28 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 	CFLAGS="${CFLAGS} ${OPENSSL_CFLAGS}"
 	LIBS="${LIBS} ${OPENSSL_LIBS}"
 
+	# If pkgconfig check failed or OPENSSL_CFLAGS/OPENSSL_LIBS env vars
+	# are used, check the version directly in the OpenSSL include file
+	if test "${have_openssl}" != "yes"; then
+	   AC_MSG_CHECKING([additionally if OpenSSL is available and version >= 1.0.1])
+	   AC_COMPILE_IFELSE(
+		[AC_LANG_PROGRAM(
+			[[
+#include <openssl/opensslv.h>
+			]],
+			[[
+/*	     Version encoding: MNNFFPPS - see opensslv.h for details */
+#if OPENSSL_VERSION_NUMBER < 0x10001000L
+#error OpenSSL too old
+#endif
+			]]

configure.ac if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then · line 897

Quoted 10 lines

configure.ac +7 -0

+		)],
+		[AC_MSG_RESULT([ok])],
+		[AC_MSG_ERROR([OpenSSL version too old])]
+	   )
+	   OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
+	fi
+
 	AC_CHECK_FUNCS([SSL_CTX_new EVP_CIPHER_CTX_set_key_length],
 				   ,
 				   [AC_MSG_ERROR([openssl check failed])]

This looks good now, ACK.

-Steffan

Gert Doering

2017-04-22 11:29 UTC #11 lore raw

Hi,

Quoted 3 lines · Steffan Karger

Quoted 3 lines
v4 - Move the CFLAGS/LDFLAGS declarations before the manual
version test; otherwise we're still testing the system install version

[..]

Quoted 1 line

This looks good now, ACK.

I'm not exactly sure what happened here in v4 - but now it's broken for "just run configure, with no extra WITH_OPENSSL_* arguments" (on a system without pkgconfig). So, NAK, as annoying as you'll surely find me :-/

It does the version check just fine...

configure:16566: checking additionally if OpenSSL is available and version >= 1. 0.1
configure:16587: cc -c -g -O2 -std=c99 conftest.c >&5
configure:16587: $? = 0
configure:16588: result: ok

... and then it tests for SSL_CTX_new, omitting the -lssl/-lcrypto bits:

configure:16601: checking for SSL_CTX_new
configure:16601: cc -o conftest -g -O2 -std=c99 conftest.c >&5
/var/tmp/conftest-e1c536.o: In function `main':
/home/gert/src/openvpn-maint/test-build-master-fbsd/conftest.c:193: undefined re ference to `SSL_CTX_new'
cc: error: linker command failed with exit code 1 (use -v to see invocation)

... failing.

This is on FreeBSD 10.3, with the system libs, having pkg-config installed, but no openssl.pc:

configure:16509: $PKG_CONFIG --exists --print-errors "libcrypto >= 1.0.1, libssl

Quoted 1 line

= 1.0.1"

Package libcrypto was not found in the pkg-config search path. Perhaps you should add the directory containing `libcrypto.pc' to the PKG_CONFIG_PATH environment variable
Package 'libcrypto', required by 'virtual:world', not found Package 'libssl', required by 'virtual:world', not found

(not sure if this is related, but maybe the configure code path for "pkg-config exists" is different from "no pkg-config found")

On Linux, with pkg-config + openssl.pc, it works fine:

configure:16601: checking for SSL_CTX_new
configure:16601: gcc -o conftest -g -O2 -std=c99 conftest.c -lcrypto -lssl

Quoted 1 line

&5

configure:16601: $? = 0
configure:16601: result: yes

(-lcrypto -lssl present, though I wonder why it's putting -lcrypto first - dependency order should have -lssl first)

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

David Sommerseth

2017-04-22 15:27 UTC #12 lore raw

Quoted 50 lines · Gert Doering

Hi,
Quoted 3 lines · Steffan Karger
Quoted 3 lines
v4 - Move the CFLAGS/LDFLAGS declarations before the manual
version test; otherwise we're still testing the system install version
[..]
Quoted 1 line
This looks good now, ACK.
I'm not exactly sure what happened here in v4 - but now it's broken for "just run configure, with no extra WITH_OPENSSL_* arguments" (on a system without pkgconfig). So, NAK, as annoying as you'll surely find me :-/
It does the version check just fine...
configure:16566: checking additionally if OpenSSL is available and version >= 1. 0.1
configure:16587: cc -c -g -O2 -std=c99 conftest.c >&5
configure:16587: $? = 0
configure:16588: result: ok
... and then it tests for SSL_CTX_new, omitting the -lssl/-lcrypto bits:
configure:16601: checking for SSL_CTX_new
configure:16601: cc -o conftest -g -O2 -std=c99 conftest.c >&5
/var/tmp/conftest-e1c536.o: In function `main':
/home/gert/src/openvpn-maint/test-build-master-fbsd/conftest.c:193: undefined re ference to `SSL_CTX_new'
cc: error: linker command failed with exit code 1 (use -v to see invocation)
... failing.
This is on FreeBSD 10.3, with the system libs, having pkg-config installed, but no openssl.pc:
configure:16509: $PKG_CONFIG --exists --print-errors "libcrypto >= 1.0.1, libssl
Quoted 1 line
= 1.0.1"
Package libcrypto was not found in the pkg-config search path. Perhaps you should add the directory containing `libcrypto.pc' to the PKG_CONFIG_PATH environment variable
Package 'libcrypto', required by 'virtual:world', not found Package 'libssl', required by 'virtual:world', not found
(not sure if this is related, but maybe the configure code path for "pkg-config exists" is different from "no pkg-config found")
On Linux, with pkg-config + openssl.pc, it works fine:

Quoted 8 lines

configure:16601: checking for SSL_CTX_new
configure:16601: gcc -o conftest -g -O2 -std=c99 conftest.c -lcrypto -lssl
Quoted 1 line
&5
configure:16601: $? = 0
configure:16601: result: yes
(-lcrypto -lssl present, though I wonder why it's putting -lcrypto first - dependency order should have -lssl first)

I will dig further into this an submit a v5. Gee, this autotools stuff can be fragile. Each time I fight with autotools, I think of migrating to CMake. But each time I struggle with CMake, I think of migrating to autotools. I so wonder if there are some sane alternatives - somewhat, I doubt so :/

Signature · 4 lines

kind regards,

David Sommerseth
OpenVPN Technologies, Inc

Steffan Karger

2017-04-23 08:12 UTC #13 lore raw

Quoted 55 lines · David Sommerseth

Quoted 54 lines · Gert Doering
Quoted 3 lines · Steffan Karger
Quoted 3 lines
v4 - Move the CFLAGS/LDFLAGS declarations before the manual
version test; otherwise we're still testing the system install version
[..]
Quoted 1 line
This looks good now, ACK.
I'm not exactly sure what happened here in v4 - but now it's broken for "just run configure, with no extra WITH_OPENSSL_* arguments" (on a system without pkgconfig). So, NAK, as annoying as you'll surely find me :-/
It does the version check just fine...
configure:16566: checking additionally if OpenSSL is available and version >= 1. 0.1
configure:16587: cc -c -g -O2 -std=c99 conftest.c >&5
configure:16587: $? = 0
configure:16588: result: ok
... and then it tests for SSL_CTX_new, omitting the -lssl/-lcrypto bits:
configure:16601: checking for SSL_CTX_new
configure:16601: cc -o conftest -g -O2 -std=c99 conftest.c >&5
/var/tmp/conftest-e1c536.o: In function `main':
/home/gert/src/openvpn-maint/test-build-master-fbsd/conftest.c:193: undefined re ference to `SSL_CTX_new'
cc: error: linker command failed with exit code 1 (use -v to see invocation)
... failing.
This is on FreeBSD 10.3, with the system libs, having pkg-config installed, but no openssl.pc:
configure:16509: $PKG_CONFIG --exists --print-errors "libcrypto >= 1.0.1, libssl
Quoted 1 line
= 1.0.1"
Package libcrypto was not found in the pkg-config search path. Perhaps you should add the directory containing `libcrypto.pc' to the PKG_CONFIG_PATH environment variable
Package 'libcrypto', required by 'virtual:world', not found Package 'libssl', required by 'virtual:world', not found
(not sure if this is related, but maybe the configure code path for "pkg-config exists" is different from "no pkg-config found")
On Linux, with pkg-config + openssl.pc, it works fine:
configure:16601: checking for SSL_CTX_new
configure:16601: gcc -o conftest -g -O2 -std=c99 conftest.c -lcrypto -lssl
Quoted 1 line
&5
configure:16601: $? = 0
configure:16601: result: yes

Quoted 8 lines

Quoted 2 lines
(-lcrypto -lssl present, though I wonder why it's putting -lcrypto first - dependency order should have -lssl first)
I will dig further into this an submit a v5. Gee, this autotools stuff can be fragile. Each time I fight with autotools, I think of migrating to CMake. But each time I struggle with CMake, I think of migrating to autotools. I so wonder if there are some sane alternatives - somewhat, I doubt so :/

Gah, of course.

Two things:

1) The OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto} line should be at the old location, and the new one should go. That's why it now fails on systems without pkg-config or _LIBS set manually.

2) The incorrect linking order is related to the stuff from ticket #863. "[libcrypto >= 1.0.1, libssl >= 1.0.1]" should be replaced with
"[openssl >= 1.0.1]". I was waiting for this patch to get through before sending a follow-up patch for that, but I'm fine with integrating that into this patch too.

-Steffan

David Sommerseth

author

2017-04-24 14:39 UTC #14 lore raw

PATCH v5 1/1 Fix broken ./configure on systems without openssl.pc

In reply to David Sommerseth

If the user adds OPENSSL_CFLAGS or OPENSSL_LIBS to the ./configure script, the pkg-config will not be run. But this patch ensures that the OpenSSL version is also checked in this situation.

This patch have been tested on Scientic Linux 7.3 (RHEL clone) and FreeBSD 10.3-RELEASE-p11.

v5 - Remove the right OPENSSL_LIBS and preserve the old one
- In PKG_CHECK_MODULES(), check for openssl instead of libssl
+ libcrypto
- Fix tab/space issues once again

v4 - Move the CFLAGS/LDFLAGS declarations before the manual
version test; otherwise we're still testing the system install version

v3 - Remove not needed and duplicated OPENSSL_LIBS assignment
- Fix tab/space issues in modified lines

v2 - Don't use try to simplify the version matching, use the full
OPENSSL_VERSION_NUMBER
- Fixed typo (OpneSSL -> OpenSSL)
- Improve a few comments

Signed-off-by David Sommerseth <[email protected]...>

---
 configure.ac | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

configure.ac +24 -4

index acea060..7d3fce5 100644
@@ -859,11 +859,10 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 		# if the user did not explicitly specify flags, try to autodetect
 		PKG_CHECK_MODULES(
 			[OPENSSL],
-			[libcrypto >= 1.0.1, libssl >= 1.0.1],
-	                [have_openssl="yes"],
-			[AC_MSG_ERROR([Minimum supported OpenSSL version is 1.0.1])]
+			[openssl >= 1.0.1],
+			[have_openssl="yes"],
+			[] # If this fails, we will do another test next
 		)
-
 		OPENSSL_LIBS=${OPENSSL_LIBS:--lssl -lcrypto}
 	fi

@@ -872,6 +871,27 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 	CFLAGS="${CFLAGS} ${OPENSSL_CFLAGS}"
 	LIBS="${LIBS} ${OPENSSL_LIBS}"
 
+	# If pkgconfig check failed or OPENSSL_CFLAGS/OPENSSL_LIBS env vars
+	# are used, check the version directly in the OpenSSL include file
+	if test "${have_openssl}" != "yes"; then
+		AC_MSG_CHECKING([additionally if OpenSSL is available and version >= 1.0.1])
+		AC_COMPILE_IFELSE(
+			[AC_LANG_PROGRAM(
+				[[
+#include <openssl/opensslv.h>
+				]],
+				[[
+/*	     Version encoding: MNNFFPPS - see opensslv.h for details */
+#if OPENSSL_VERSION_NUMBER < 0x10001000L
+#error OpenSSL too old
+#endif
+				]]
+			)],
+			[AC_MSG_RESULT([ok])],
+			[AC_MSG_ERROR([OpenSSL version too old])]
+		)
+	fi
+
 	AC_CHECK_FUNCS([SSL_CTX_new EVP_CIPHER_CTX_set_key_length],
 				   ,
 				   [AC_MSG_ERROR([openssl check failed])]

Signature · 1 line

2.11.0

Gert Doering

2017-04-24 20:57 UTC #15 lore raw

Hi,

Quoted 7 lines · David Sommerseth

This patch have been tested on Scientic Linux 7.3 (RHEL clone) and FreeBSD 10.3-RELEASE-p11.
v5 - Remove the right OPENSSL_LIBS and preserve the old one
- In PKG_CHECK_MODULES(), check for openssl instead of libssl
+ libcrypto
- Fix tab/space issues once again

[..]

This looks good for me.

FreeBSD 10.3, no pkg-config -> works
Gentoo, pkg-config -> works
FreeBSD 7.3, no pkg-config, openssl 0.9.8 -> fails (as it should)

checking for OPENSSL... no
checking additionally if OpenSSL is available and version >= 1.0.1... configure: error: OpenSSL version too old

NetBSD 7.0.1, pkg-config, openssl 1.0.1t -> works
OpenBSD 6.0, pkg-config, LibreSSL 2.4.2 (OPENSSL_VERSION_NUMBER 0x20000000L)

                                          -> works

I'd like to see a review from Steffan whether we've anything left that I didn't see in my setups (I run without setting env vars, with openssl installed "in the default places"), but for my machines, this is good to go (=ACK).

[I'll have to go and upgrade a number of the older buildslaves, as some of these do have 0.9.8<x> installed - so expect some errors when pushing, but this is understood and inveitable]

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

Steffan Karger

2017-04-25 17:19 UTC #16 lore raw

Hi,

Quoted 21 lines · Gert Doering

Quoted 7 lines · David Sommerseth
This patch have been tested on Scientic Linux 7.3 (RHEL clone) and FreeBSD 10.3-RELEASE-p11.
v5 - Remove the right OPENSSL_LIBS and preserve the old one
- In PKG_CHECK_MODULES(), check for openssl instead of libssl
+ libcrypto
- Fix tab/space issues once again
[..]
This looks good for me.
FreeBSD 10.3, no pkg-config -> works
Gentoo, pkg-config -> works
FreeBSD 7.3, no pkg-config, openssl 0.9.8 -> fails (as it should)
checking for OPENSSL... no
checking additionally if OpenSSL is available and version >= 1.0.1... configure: error: OpenSSL version too old
NetBSD 7.0.1, pkg-config, openssl 1.0.1t -> works
OpenBSD 6.0, pkg-config, LibreSSL 2.4.2 (OPENSSL_VERSION_NUMBER 0x20000000L)

Quoted 7 lines

                                          -> works
I'd like to see a review from Steffan whether we've anything left that I didn't see in my setups (I run without setting env vars, with openssl installed "in the default places"), but for my machines, this is good to go (=ACK).

This works fine with my OPENSSL_LIBS and OPENSSL_CFLAGS build setup too.
Patch looks good. So, ACK :)

-Steffan

Gert Doering

2017-04-25 19:32 UTC #17 lore raw

In reply to David Sommerseth

ACK (as mailed yesterday already).

Your patch has been applied to the master branch.

commit 79ea67f77ca3afe91222f62e17df885a30409285

Author: David Sommerseth
Date:   Mon Apr 24 16:39:10 2017 +0200

     Fix broken ./configure on systems without openssl.pc

     Signed-off-by: David Sommerseth <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Acked-by: Steffan Karger <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg14503.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering