Return-Path: X-Original-To: apmail-httpd-dev-archive@www.apache.org Delivered-To: apmail-httpd-dev-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id E3AEF10B81 for ; Fri, 5 Jun 2015 12:16:34 +0000 (UTC) Received: (qmail 18990 invoked by uid 500); 5 Jun 2015 12:16:00 -0000 Delivered-To: apmail-httpd-dev-archive@httpd.apache.org Received: (qmail 18919 invoked by uid 500); 5 Jun 2015 12:16:00 -0000 Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm Precedence: bulk Reply-To: dev@httpd.apache.org list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list dev@httpd.apache.org Received: (qmail 18900 invoked by uid 99); 5 Jun 2015 12:16:00 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 05 Jun 2015 12:16:00 +0000 X-ASF-Spam-Status: No, hits=1.5 required=5.0 tests=HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of mamfelt@gmail.com designates 209.85.160.169 as permitted sender) Received: from [209.85.160.169] (HELO mail-yk0-f169.google.com) (209.85.160.169) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 05 Jun 2015 12:13:45 +0000 Received: by yked142 with SMTP id d142so23937018yke.3; Fri, 05 Jun 2015 05:15:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=enmc3C7YWIvt2QHmbS+Y/o6zu6/ql6zNJ5fmA1I3s8I=; b=h2+4uZNk6DCaXGC6tZtUIcTtFrjT7pq9I0LVVGYXhBIlvArRF6YUZCS075wApX6zny dgazseFK72TAdMDmTRXq9LdqkM9XnjroB5/mavoT9FiVBuRu8XzR+oGdBF1F98uv2D1s 20hcXXJVmzQghqSfmr3yR1aQRdznZI35VpnrKc8bfIFdUV6O9Dgc/79T13fr2L0x3s8t GYkolW426HQz2tAfzufqJqoEskC5477isk5+MIMKuPY8kmXO99lZb3TAuDu8GhmwSl6z NS0M6Ct6IUDzZjBuhyD4HbJNMdxsEg31LmDbRleEfJU3emMcF9so8TfETTJVMNFw8lgz uF5w== MIME-Version: 1.0 X-Received: by 10.236.8.5 with SMTP id 5mr2770746yhq.179.1433506533187; Fri, 05 Jun 2015 05:15:33 -0700 (PDT) Received: by 10.13.193.69 with HTTP; Fri, 5 Jun 2015 05:15:33 -0700 (PDT) In-Reply-To: References: Date: Fri, 5 Jun 2015 14:15:33 +0200 Message-ID: Subject: Re: httpd and OpenSSL 1.0.2 From: Michael Felt To: dev@httpd.apache.org Cc: Mario Brandt , users@httpd.apache.org Content-Type: multipart/alternative; boundary=089e0118241ab1a4140517c43f13 X-Virus-Checked: Checked by ClamAV on apache.org --089e0118241ab1a4140517c43f13 Content-Type: text/plain; charset=UTF-8 Along the lines of "to be continued" - IMHO httpd should be one of the early adopters of not allowing linkage to versions of openssl that cannot support TLS1.2. I have built (on AIX) against libreSSL (v2.1.6) with some private additions for AIX (that will be verified and improved upon by openbsd in the soon to be released libreSSL 2.2 version). Basically, there are only two defines that were 'missing'. One was rather 'obscure' it what it is suppossed to be doing (i.e., looking in the openssl code) - the other was downright 'dangerous" because it permits 'any external so-called enthrophy generator' to be added and used for randomness - because it is, or at least was, part of the openSSL libraries. (the approach of libreSSL was to completely remove it, hence a missing #define). Again - to be continued. and asap - in a separate post I will post the differences to get it to link against libreSSL (p.s. only mod_ssl needs this afaik). On Wed, May 27, 2015 at 3:29 PM, Tom Browder wrote: > On May 27, 2015 5:26 AM, "Mario Brandt" wrote: > > Hi Tom, > > I saw you on the httpd dev mailing list about that topic. How did you > > manage to build apache against 1.0.2? > > > > Cause if I try that I get in my VM > > > > /opt/apache2/modules/mod_ssl.so: undefined symbol: SSL_CONF_CTX_finish > > > > or on my real server > > > > /opt/apache2/modules/mod_ssl.so: undefined symbol: SSL_CONF_CTX_free > > > > OpenSSL > > ./config --prefix=/usr zlib-dynamic --openssldir=/etc/ssl shared no-ssl2 > > make depend > > make > > sudo make install > > > > > > apache > > ./configure --prefix=/opt/apache2 --enable-pie > > --enable-mods-shared=all --enable-so --disable-include --enable-lua > > --enable-deflate --enable-headers --enable-expires --enable-ssl=shared > > --enable-mpms-shared=all --with-mpm=event --enable-rewrite > > --with-z=$HOME/apache24/httpd-2.4.12/srclib/zlib --enable-module=ssl > > --enable-fcgid --with-included-apr > > --with-openssl=$HOME/apache24/openssl-1.0.2a > > --enable-ssl-staticlib-deps > > > > with the 1.0.1m it works all fine > > seehttps:// > github.com/JBlond/debian_build_apache24/blob/master/build_apache.sh > > > > > > Please tell me how you got it working. > > Mario, I did get it working, but I did have a bit more effort to make > the latest openssl work. Taking a quick look at your blog I believe I > can help, but I'll explain my solution in a follow-up message so this > thread is on the public mailing lists. > > I feel I must explain that I'm using a Debian 7, 64-bit server. It > might help if we could know your server info as other architectures > may require more or other tweaks. > > Finally, the best I can probably do is show you my configure options > which may conflict with yours. > > TO BE CONTINUED.... > > Best regards, > > -Tom > --089e0118241ab1a4140517c43f13 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Along the lines of "to be continued&qu= ot; - IMHO httpd should be one of the early adopters of not allowing linkag= e to versions of openssl that cannot support TLS1.2.

I have bu= ilt (on AIX) against libreSSL (v2.1.6) with some private additions for AIX = (that will be verified and improved upon by openbsd in the soon to be relea= sed libreSSL 2.2 version).

Basically, there are only two defin= es that were 'missing'. One was rather 'obscure' it what it= is suppossed to be doing (i.e., looking in the openssl code) - the other w= as downright 'dangerous" because it permits 'any external so-c= alled enthrophy generator' to be added and used for randomness - becaus= e it is, or at least was, part of the openSSL libraries. (the approach of l= ibreSSL was to completely remove it, hence a missing #define).

Again - to be continued. and asap - in a separate post I will post the dif= ferences to get it to link against libreSSL (p.s. only mod_ssl needs this a= faik).

O= n Wed, May 27, 2015 at 3:29 PM, Tom Browder <tom.browder@gmail.com> wrote:
On May 27, 2015 5:26= AM, "Mario Brandt" <jblon= d@gmail.com> wrote:
> Hi Tom,
> I saw you on the httpd dev mailing list about that topic. How did you<= br> > manage to build apache against 1.0.2?
>
> Cause if I try that I get in my VM
>
> /opt/apache2/modules/mod_ssl.so: undefined symbol: SSL_CONF_CTX_finish=
>
> or on my real server
>
> /opt/apache2/modules/mod_ssl.so: undefined symbol: SSL_CONF_CTX_free >
> OpenSSL
> ./config --prefix=3D/usr zlib-dynamic --openssldir=3D/etc/ssl shared n= o-ssl2
> make depend
> make
> sudo make install
>
>
> apache
> ./configure --prefix=3D/opt/apache2 --enable-pie
> --enable-mods-shared=3Dall --enable-so --disable-include --enable-lua<= br> > --enable-deflate --enable-headers --enable-expires --enable-ssl=3Dshar= ed
> --enable-mpms-shared=3Dall --with-mpm=3Devent --enable-rewrite
> --with-z=3D$HOME/apache24/httpd-2.4.12/srclib/zlib --enable-module=3Ds= sl
> --enable-fcgid --with-included-apr
> --with-openssl=3D$HOME/apache24/openssl-1.0.2a
> --enable-ssl-staticlib-deps
>
> with the 1.0.1m it works all fine
> seehttps://github.com/JBlond/debian_buil= d_apache24/blob/master/build_apache.sh
>
>
> Please tell me how you got it working.

Mario, I did get it working, but I did have a bit more effort to make
the latest openssl work.=C2=A0 Taking a quick look at your blog I believe I=
can help, but I'll explain my solution in a follow-up message so this thread is on the public mailing lists.

I feel I must explain that I'm using a Debian 7, 64-bit server.=C2=A0 I= t
might help if we could know your server info as other architectures
may require more or other tweaks.

Finally, the best I can probably do is show you my configure options
which may conflict with yours.

TO BE CONTINUED....

Best regards,

-Tom

--089e0118241ab1a4140517c43f13--