Subject: Problems compiling mod_ssl with apache 2.0.44

From: Erik Melkersson <[email-masked]>
Date: Thu, 06 Feb 2003 09:49:26 +0100

Hi!
(Sending this again after finally succesfully subscribing, so sorry if 
you get it twice)

I'm trying to compile Apache 2.0.44 with mod_ssl and have some problems.

I've downloaded and installed openssl-0.9.7. Using:
./config --prefix=/service/apache2/openssl/
--openssldir=/service/apache2/openssl/
I could use those files to compile cadaver.

But when I try to compile apache:
./configure --prefix=/service/apache2
--exec-prefix=/service/apache2/arch/linux-intel --enable-dav
--enable-ssl --with-ssl=/service/apache2/openssl/
...a lot of rows...
make
...a lot of rows...
/bin/sh /usr/local/service/apache2/src/httpd-2.0.44/srclib/apr/libtool
--silent --mode=link gcc  -g -O2 -pthread    -DLINUX=2 -D_REENTRANT
-D_XOPEN_SOURCE=500 -D_BSD_SOURCE -D_SVID_SOURCE
-DAP_HAVE_DESIGNATED_INITIALIZER
-I/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr/include
-I/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/include
-I/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/xml/expat/lib
-I. -I/usr/local/service/apache2/src/httpd-2.0.44/os/unix
-I/usr/local/service/apache2/src/httpd-2.0.44/server/mpm/prefork
-I/usr/local/service/apache2/src/httpd-2.0.44/modules/http
-I/usr/local/service/apache2/src/httpd-2.0.44/modules/filters
-I/usr/local/service/apache2/src/httpd-2.0.44/modules/proxy
-I/usr/local/service/apache2/src/httpd-2.0.44/include
-I/service/apache2/openssl//include/openssl
-I/service/apache2/openssl//include
-I/usr/local/service/apache2/src/httpd-2.0.44/modules/dav/main
-export-dynamic
-L/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/xml/expat/lib
-L/service/apache2/openssl//lib   -o httpd  modules.lo
modules/aaa/mod_access.la modules/aaa/mod_auth.la
modules/filters/mod_include.la modules/loggers/mod_log_config.la
modules/metadata/mod_env.la modules/metadata/mod_setenvif.la
modules/ssl/mod_ssl.la modules/http/mod_http.la modules/http/mod_mime.la
modules/dav/main/mod_dav.la modules/generators/mod_status.la
modules/generators/mod_autoindex.la modules/generators/mod_asis.la
modules/generators/mod_cgi.la modules/dav/fs/mod_dav_fs.la
modules/mappers/mod_negotiation.la modules/mappers/mod_dir.la
modules/mappers/mod_imap.la modules/mappers/mod_actions.la
modules/mappers/mod_userdir.la modules/mappers/mod_alias.la
modules/mappers/mod_so.la server/mpm/prefork/libprefork.la
server/libmain.la os/unix/libos.la -lssl -lcrypto
/usr/local/service/apache2/src/httpd-2.0.44/srclib/pcre/libpcre.la
/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/libaprutil-0.la
-lgdbm -ldb
/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/xml/expat/lib/libexpat.la 

/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr/libapr-0.la -lm
-lcrypt -lnsl -lresolv -ldl
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_INFO_value'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_NAME_value'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_NAME_push'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_SSL_CIPHER_num'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_NAME_num'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_SSL_CIPHER_value'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_pop_free'
modules/ssl/.libs/mod_ssl.so: undefined reference to
`sk_X509_NAME_ENTRY_num'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_SSL_CIPHER_dup'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_REVOKED_value'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_INFO_num'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_value'
modules/ssl/.libs/mod_ssl.so: undefined reference to
`sk_X509_NAME_ENTRY_value'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_num'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_SSL_CIPHER_free'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_INFO_pop_free'
modules/ssl/.libs/mod_ssl.so: undefined reference to
`sk_X509_NAME_set_cmp_func'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_push'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_NAME_free'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_INFO_new_null'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_NAME_new'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_NAME_find'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_REVOKED_num'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_SSL_CIPHER_find'
modules/ssl/.libs/mod_ssl.so: undefined reference to `sk_X509_INFO_free'
modules/ssl/.libs/mod_ssl.so: undefined reference to `OPENSSL_free'
collect2: ld returned 1 exit status
make[1]: *** [httpd] Error 1
make[1]: Leaving directory `/usr/local/service/apache2/src/httpd-2.0.44'
make: *** [all-recursive] Error 1

Am I missing a lib or something that should have the sk_-stuff?
Some help would be appreciated?

Regards Erik Melkersson

-- 
__________________________
Erik Melkersson, Technical Webmaster
UNIT, Linköpings Universitet
[email-masked], 013-285794
http://www.unit.liu.se/

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Geoff Thorpe <[email-masked]>
Date: Thu, 06 Feb 2003 14:18:25 -0500

Hello,

My first guess would be that you have another version of openssl
libraries and/or headers installed on your system. The kind of linker
error you report usually suggests the code was compiled against one
openssl version's headers, but is trying to link against a different
openssl version's libraries. If my hunch is right, you have an older
version of openssl installed on the system and your code is using the
older version's headers but trying to link against your 0.9.7
installation in /service/apache2/openssl.

I can't test any of this right now so I'm flying a little blind, but
here's a couple of ideas;

(1) If you can (even temporarily) move the system's existing openssl
headers (and libs, for safety) out of the way and try again, you would
see if apache finds the correct headers and libs for sure.

(2) Try forcing the include path in a different way, eg; configure
    apache2 like;
    # export CFLAGS="-I/service/apache2/openssl/include"
    # ./configure --prefix=/service/apache2/ <etc ...>

Good luck,
Geoff

PS: If that leads nowhere, you may want to post your query to one of the
apache2 mailing lists - a version of mod_ssl is now included there and
this sort of configuration issue is quite different between adding
mod_ssl to apache 1.3 and using apache2's builtin version.

-- 
Geoff Thorpe
[email-masked]
http://www.geoffthorpe.net/

---

From: Erik Melkersson <[email-masked]>
Date: Fri, 07 Feb 2003 10:25:51 +0100

Hi!

Thanks for the reply.

Geoff Thorpe wrote:
> ... The kind of linker
> openssl version's libraries....

Yes, I tried to compile it against different openssl-version and didn't 
make clean in betweend (dumb fault by me)

After cleaning and compiling again we get some other errors.
undefined reference to OPENSSL_free, RAND_egd and RAND_status (se below 
for complete data)

In order to make apache compile we
- changed OPENSSL_free to CRYPTO_free in a #define in the modules/ssl/ 
headers file. (As that is done in openssl anyway)
- commented out the 3+3 lines where RAND_egd and RAND_status are used in 
modules/ssl/ssl_engine_rand.c

Now we can compile and use it over ssl even though commenting out non 
working code is propably a bad thing to do.

./configure --prefix=/service/apache2 
--exec-prefix=/service/apache2/arch/linux-intel --enable-ssl 
--with-openssl=/service/apache2/openssl/
...lots of rows...
make
...lots of rows...
/bin/sh /usr/local/service/apache2/src/httpd-2.0.44/srclib/apr/libtool 
--mode=link gcc  -g -O2 -pthread    -DLINUX=2 -D_REENTRANT 
-D_XOPEN_SOURCE=500 -D_BSD_SOURCE -D_SVID_SOURCE 
-DAP_HAVE_DESIGNATED_INITIALIZER 
-I/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr/include 
-I/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/include 
-I/service/apache2/openssl/include 
-I/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/xml/expat/lib 
-I. -I/usr/local/service/apache2/src/httpd-2.0.44/os/unix 
-I/usr/local/service/apache2/src/httpd-2.0.44/server/mpm/prefork 
-I/usr/local/service/apache2/src/httpd-2.0.44/modules/http 
-I/usr/local/service/apache2/src/httpd-2.0.44/modules/filters 
-I/usr/local/service/apache2/src/httpd-2.0.44/modules/proxy 
-I/usr/local/service/apache2/src/httpd-2.0.44/include 
-I/usr/local/ssl/include/openssl -I/usr/local/ssl/include 
-I/usr/local/service/apache2/src/httpd-2.0.44/modules/dav/main 
-export-dynamic 
-L/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/xml/expat/lib 
-L/usr/local/ssl/lib   -o httpd  modules.lo  modules/aaa/mod_access.la 
modules/aaa/mod_auth.la modules/filters/mod_include.la 
modules/loggers/mod_log_config.la modules/metadata/mod_env.la 
modules/metadata/mod_setenvif.la modules/ssl/mod_ssl.la 
modules/http/mod_http.la modules/http/mod_mime.la 
modules/generators/mod_status.la modules/generators/mod_autoindex.la 
modules/generators/mod_asis.la modules/generators/mod_cgi.la 
modules/mappers/mod_negotiation.la modules/mappers/mod_dir.la 
modules/mappers/mod_imap.la modules/mappers/mod_actions.la 
modules/mappers/mod_userdir.la modules/mappers/mod_alias.la 
modules/mappers/mod_so.la server/mpm/prefork/libprefork.la 
server/libmain.la os/unix/libos.la -lssl -lcrypto 
/usr/local/service/apache2/src/httpd-2.0.44/srclib/pcre/libpcre.la 
/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/libaprutil-0.la 
-lgdbm -ldb 
/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr-util/xml/expat/lib/libexpat.la 
/usr/local/service/apache2/src/httpd-2.0.44/srclib/apr/libapr-0.la -lm 
-lcrypt -lnsl -lresolv -ldl
modules/ssl/.libs/mod_ssl.al(ssl_engine_kernel.lo): In function 
`ssl_hook_UserCheck':
/usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_kernel.c:875: 
undefined reference to `OPENSSL_free'
modules/ssl/.libs/mod_ssl.al(ssl_engine_kernel.lo): In function 
`ssl_callback_SSLVerify':
/usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_kernel.c:1206: 
undefined reference to `OPENSSL_free'
/usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_kernel.c:1210: 
undefined reference to `OPENSSL_free'
modules/ssl/.libs/mod_ssl.al(ssl_engine_kernel.lo): In function 
`ssl_callback_SSLVerify_CRL':
/usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_kernel.c:1469: 
undefined reference to `OPENSSL_free'
modules/ssl/.libs/mod_ssl.al(ssl_engine_kernel.lo): In function 
`modssl_proxy_info_log':
/usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_kernel.c:1507: 
undefined reference to `OPENSSL_free'
modules/ssl/.libs/mod_ssl.al(ssl_engine_rand.lo): In function 
`ssl_rand_seed':
/usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_rand.c:125: 
undefined reference to `RAND_egd'
/usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_rand.c:163: 
undefined reference to `RAND_status'
modules/ssl/.libs/mod_ssl.al(ssl_engine_vars.lo): In function 
`ssl_var_lookup_ssl_cert':
/usr/local/service/apache2/src/httpd-2.0.44/modules/ssl/ssl_engine_vars.c:351: 
undefined reference to `OPENSSL_free'

Machine running Linux 2.2.17-14smp (RedHat 6.2)
openssl 0.9.7
apache 2.0.44

---

From: Sasa STUPAR <[email-masked]>
Date: Fri, 07 Feb 2003 10:38:39 +0100

I have just succesfully compiled apache 2.0.44 with mod_ssl and openssl
0.9.7 on RH8. First I have compiled openssl then apache and everything
works fine. On trick after make install in openssl it doesn't copy
headers so you have to manually copy them to your install directory.

---

From: Geoff Thorpe <[email-masked]>
Date: Fri, 07 Feb 2003 13:14:31 -0500

Hello,

> make clean in betweend (dumb fault by me)

Ah, that would've helped :-)

> undefined reference to OPENSSL_free, RAND_egd and RAND_status (se below 

Erm ...

> modules/ssl/ssl_engine_rand.c

None of this should be required if you are compiling against a matching
set of openssl headers and libraries. I suggest for your own benefit
that you get to the bottom of the problem rather than using the tricks
you have - it is known (and in fact reiterated time after time by myself
and other openssl developers) that no binary compatibility should be
assumed from one openssl release to the next until at least version 1.0.
So if you've had to hack to get past the linker stage, and you're so far
lucky enough to have the basic functionality "ok" at run-time without
any noticable explosions, you could still be sitting on a behavioural
time-bomb.

BTW: What you've done w.r.t. RAND_*** functions could cause your server
to either (a) fail handshakes with certain client browsers due to PRNG
problems, or worse (b) appear to negotiate fine with everyone despite
using insecure parameters. Which of those risks is greater rather
depends on how you've hacked apache2's code, but either way it shouldn't
be required if your build environment (and openssl installation) is ok.

> working code is propably a bad thing to do.

It is, and it could bite you in unknown ways later on. I'd recommend
figuring out why you had to do the things you did to get apache working
- it should be very straightforward and require no such hacking.

Cheers,
Geoff

---

From: Geoff Thorpe <[email-masked]>
Date: Fri, 07 Feb 2003 13:17:43 -0500

> headers so you have to manually copy them to your install directory.

It doesn't? It certainly should - can you please double-check this and
report the details to me if it's true? Noone (to my knowledge) has
reported this problem and openssl 0.9.7 has been through a fairly
extensive beta testing period (during which the header installation
didn't AFAICS require any hacking).

Cheers,
Geoff

---

From: Sasa STUPAR <[email-masked]>
Date: Fri, 07 Feb 2003 19:59:26 +0100

No, It doesn't. I have compiled it with prefix /usr/include and
openssldir /usr/include/openssl and there are no headers. I haven't
noticed it on first but when I wanted to compile apache with mod_ssl it
returns an error that it was unable to find headers for ssl.
Is there someone else reporting the same problem ? Maybe is this related
to the RedHat8 distrubution only.

Sasa

---

From: Geoff Thorpe <[email-masked]>
Date: Fri, 07 Feb 2003 18:48:07 -0500

> to the RedHat8 distrubution only.

Well RH8 has openssl bundled though probably not with the headers, and I
can't say much else about what RH might be doing because I don't use it.
However, trying to install to a prefix of /usr/include would be pretty
terrible - as it will install all binaries, libraries, and include files
in *sub-directories* of /usr/include! Are you sure you did this, or did
you mean /usr/local?

Anyway, I'd be interested to see a log of this problem if you wouldn't
mind? If there's an openssl bug inside it, I'll try and get it
identified and fixed for the next release (0.9.7a). Eg. could you please
repeat your steps and send me the logs as;
  # ./config [...] 1> c1.log 2> c2.log
  # make [...] 1> m1.log 2> m2.log
  # make install 1> i1.log 2> i2.log
or something like that?

Cheers,
Geoff

---

From: Sasa STUPAR <[email-masked]>
Date: Sat, 08 Feb 2003 10:16:21 +0100

I have just got an email from another user of RH8 which has the same
problem. I have told him to post it on the list. So looks like there is
a problem.

Sasa

---

From: Sasa STUPAR <[email-masked]>
Date: Sat, 08 Feb 2003 10:22:05 +0100

I have forgot...Original instalation of RH8 has openssl in
/usr/include/openssl and there are all the headers. Since this is a
version 0.9.6.b I have decided to upgrade. I have made
prefix=/usr/include and openssldir=/usr/include/openssl. So after the
instalation it put the binary dir to /usr/include and to the
/usr/include/openssl dirs apps, lib,etc. In /usr/include there are no
headers so I have manually copy them to /usr/include/openssl.

---

From: Sasa STUPAR <[email-masked]>
Date: Sat, 08 Feb 2003 12:23:31 +0100

Ok, I have found the problem. If you want to have files in the same
directories as original instalation of RH8 you have to use "./config
--prefix=/usr". Sorry for that confusion. It is the distribution which
is strange.

Sasa

---

From: Geoff Thorpe <[email-masked]>
Date: Sat, 08 Feb 2003 13:08:15 -0500

> --prefix=/usr". Sorry for that confusion. It is the distribution which

Phew, I was starting to wonder what I was missing here :-) As I
mentioned originally, using "/usr/include" as an installation prefix
doesn't make sense because it will create the standard {include,bin,man}
tree beneath that and install. Hence "/usr" or "/usr/local" make more
sense. Also, especially on package management systems like RH, you're
better not to simply install *over* existing files, particularly as a
newer version of openssl may have removed headers that were in a
previous version, so the old ones will end up mixed up with the new
ones. And of course if a bug-fix release is made by RH to the older
version, eg. 0.9.6x, that could seriously screw things up if you'd
installed 0.9.7 over the top. It could also totally mangle your system's
RPM database, and various other carnage is possible.

The solution is to either grapple with RH's dependencies to try and
build a replacement openssl RPM from source to upgrade to (which many
will tell you is an only slightly less difficult problem than the
alchemy of gold itself) or to install openssl elsewhere and make sure
your system paths are organised appropriately. Eg. you could use
/usr/local or /opt as a place to manually install packages such as a
newer openssl, and make sure that the bin subdirectory is earlier in
PATH than /usr/bin, ditto for the lib subdirectory in /etc/ld.so.conf,
the man subdirectory in /etc/man.config, and so on ...

BTW: You should check your /usr/include tree that there aren't bits and
pieces of openssl cruft in there left over from your previous efforts -
eg. your previous installation attempts probably created weird
directories like /usr/include/bin, /usr/include/include, etc.

Cheers,
Geoff

---

From: Sasa STUPAR <[email-masked]>
Date: Sat, 08 Feb 2003 19:13:31 +0100

Prior to the instalation I have manually removed old version of Openssl
and other dirs from my previous installs and I have no
problem...everything works well.

Thanks for info.

Sasa

---

From: Geoff Thorpe <[email-masked]>
Date: Sat, 08 Feb 2003 13:59:01 -0500

> problem...everything works well.

Really? I'm surprised, but happy. RH typically build everything with
shared-library dependencies on openssl libs, so either you're running no
openssl-dependant software, or you're getting "lucky" with software
built for 0.9.6 linking with 0.9.7 ... eg. ssh is possibly doing this.
Anyway, I leave you and RH to get along with one another in whatever
manner suits you both :-)

Cheers,
Geoff