openssh unix dev - Jun 2018 - vanilla build of 7.7p1 release on linux/4.17 fails with gcc8 @ "/usr/bin/ld: unrecognized option '-Wl,-z,retpolineplt'"

On 8 June 2018 at 10:52, PGNet Dev <pgnet.dev at gmail.com> wrote:
[...]
> So, there's a problem for OpenSSH build with spec'ing
LD=/usr/bin/ld ?
in this particular case, apparently yes.  not generally, though.

[...]
> What's *intended* re: openssh?  Support for LD=ld or only =gcc, or
undef'd ?
Well the intent is you should be able to set CC and LD to whatever you
want as long as they work.  In this case, the OSSH_CHECK_LDFLAG_LINK
test invokes autoconf's AC_LINK_IFELSE with uses CC not LD.  I'm not
sure what to do about it yet though.

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

On 6/7/18 6:08 PM, Darren Tucker wrote:
> On 8 June 2018 at 10:52, PGNet Dev <pgnet.dev at gmail.com> wrote:
> [...]
>> So, there's a problem for OpenSSH build with spec'ing
LD=/usr/bin/ld ?
> 
> in this particular case, apparently yes.  not generally, though.
ok
> [...]
>> What's *intended* re: openssh?  Support for LD=ld or only =gcc, or
undef'd ?
> 
> Well the intent is you should be able to set CC and LD to whatever you
> want as long as they work.  In this case, the OSSH_CHECK_LDFLAG_LINK
> test invokes autoconf's AC_LINK_IFELSE with uses CC not LD.  I'm
not
> sure what to do about it yet though.
cmake! ;-)

fyi

add'l -- and looks unrelated -- issue

with either of

	LD=gcc
	unset LD

explicitly adding

	--with-pam

to config, results in a build fail around pthreads

	...
	/usr/bin/gcc-8 -O3 -Wall -fstack-protector-strong -funwind-tables
-fasynchronous-unwind-tables -fmessage-length=0 -grecord-gcc-switches
-march=native -mtune=native -pipe -Wall -Wpointer-arith -Wuninitialized
-Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign
-Wno-unused-result -fno-strict-aliasing -mfunction-return=thunk
-mindirect-branch=thunk -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset
-fstack-protector-strong -fPIE   -I. -I. -O3 -Wall -fstack-protector-strong
-funwind-tables -fasynchronous-unwind-tables -fmessage-length=0
-grecord-gcc-switches -march=native -mtune=native -D_FORTIFY_SOURCE=2
-D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE
-DSSHDIR=\"/usr/local/etc/ssh\"
-D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
-D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
-D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
-D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
-D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
-D_PATH_SSH_PIDDIR=\"/var/run\"
-D_PATH_PRIVSEP_CHROOT_DIR=\"/var/lib/sshd\" -DHAVE_CONFIG_H -c
sftp-server.c -o sftp-server.o
	auth-pam.c:179:1: error: static declaration of ?pthread_exit? follows
non-static declaration
	 pthread_exit(void *value)
	 ^~~~~~~~~~~~
	In file included from /usr/include/openssl/crypto.h:415,
	                 from /usr/include/openssl/bio.h:20,
	                 from /usr/include/openssl/objects.h:915,
	                 from buffer.h:50,
	                 from entropy.h:28,
	                 from includes.h:177,
	                 from auth-pam.c:50:
	/usr/include/pthread.h:243:13: note: previous declaration of ?pthread_exit? was
here
	 extern void pthread_exit (void *__retval) __attribute__ ((__noreturn__));
	             ^~~~~~~~~~~~
	auth-pam.c:186:1: error: conflicting types for ?pthread_create?
	 pthread_create(sp_pthread_t *thread, const void *attr,
	 ^~~~~~~~~~~~~~
	In file included from /usr/include/openssl/crypto.h:415,
	                 from /usr/include/openssl/bio.h:20,
	                 from /usr/include/openssl/objects.h:915,
	                 from buffer.h:50,
	                 from entropy.h:28,
	                 from includes.h:177,
	                 from auth-pam.c:50:
	/usr/include/pthread.h:234:12: note: previous declaration of ?pthread_create?
was here
	 extern int pthread_create (pthread_t *__restrict __newthread,
	            ^~~~~~~~~~~~~~
	auth-pam.c:212:1: error: conflicting types for ?pthread_cancel?
	 pthread_cancel(sp_pthread_t thread)
	 ^~~~~~~~~~~~~~
	In file included from /usr/include/openssl/crypto.h:415,
	                 from /usr/include/openssl/bio.h:20,
	                 from /usr/include/openssl/objects.h:915,
	                 from buffer.h:50,
	                 from entropy.h:28,
	                 from includes.h:177,
	                 from auth-pam.c:50:
	/usr/include/pthread.h:514:12: note: previous declaration of ?pthread_cancel?
was here
	 extern int pthread_cancel (pthread_t __th);
	            ^~~~~~~~~~~~~~
	auth-pam.c:220:1: error: conflicting types for ?pthread_join?
	 pthread_join(sp_pthread_t thread, void **value)
	 ^~~~~~~~~~~~
	In file included from /usr/include/openssl/crypto.h:415,
	                 from /usr/include/openssl/bio.h:20,
	                 from /usr/include/openssl/objects.h:915,
	                 from buffer.h:50,
	                 from entropy.h:28,
	                 from includes.h:177,
	                 from auth-pam.c:50:
	/usr/include/pthread.h:251:12: note: previous declaration of ?pthread_join? was
here
	 extern int pthread_join (pthread_t __th, void **__thread_return);
	            ^~~~~~~~~~~~
	make: *** [Makefile:160: auth-pam.o] Error 1

On Thu, Jun 07, 2018 at 06:14:42PM -0700, PGNet Dev
wrote:
> On 6/7/18 6:08 PM, Darren Tucker wrote:
> > Well the intent is you should be able to set CC and LD to whatever you
> > want as long as they work.  In this case, the OSSH_CHECK_LDFLAG_LINK
> > test invokes autoconf's AC_LINK_IFELSE with uses CC not LD. 
I'm not
> > sure what to do about it yet though.
I don't see a way to get AC_LINK_IFELSE to use $LD rather than $CC,
but I think we can prevent this problem by detecting the unsupported
option earlier.  Please try this diff.  It should also prevent the
warnings in the LD=gcc case.

(Note you will need to run "autoreconf" to rebuild configure after
applying it, then run ./configure.)

diff --git a/aclocal.m4 b/aclocal.m4
index ac6b6684..8b4ba126 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -25,14 +25,14 @@ int main(int argc, char **argv) {
 }
 	]])],
 		[
-if `grep -i "unrecognized option" conftest.err >/dev/null`
+if $ac_cv_path_EGREP -i "unrecognized option|warning.*ignored"
conftest.err >/dev/null
 then
 		AC_MSG_RESULT([no])
 		CFLAGS="$saved_CFLAGS"
 else
 		AC_MSG_RESULT([yes])
 		 CFLAGS="$saved_CFLAGS $_define_flag"
-fi],
+fi		],
 		[ AC_MSG_RESULT([no])
 		  CFLAGS="$saved_CFLAGS" ]
 	)
@@ -63,7 +63,7 @@ int main(int argc, char **argv) {
 }
 	]])],
 		[
-if `grep -i "unrecognized option" conftest.err >/dev/null`
+if $ac_cv_path_EGREP -i "unrecognized option|warning.*ignored"
conftest.err >/dev/null
 then
 		AC_MSG_RESULT([no])
 		CFLAGS="$saved_CFLAGS"
@@ -100,8 +100,15 @@ int main(int argc, char **argv) {
 	exit(0);
 }
 		]])],
-		[ AC_MSG_RESULT([yes])
-		  LDFLAGS="$saved_LDFLAGS $_define_flag"],
+		[
+if `$ac_cv_path_EGREP -i "unrecognized option|warning.*ignored"
conftest.err >/dev/null`
+then
+		AC_MSG_RESULT([no])
+		LDFLAGS="$saved_LDFLAGS"
+else
+		AC_MSG_RESULT([yes])
+		LDFLAGS="$saved_LDFLAGS $_define_flag"
+fi		],
 		[ AC_MSG_RESULT([no])
 		  LDFLAGS="$saved_LDFLAGS" ]
 	)

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

On 8 June 2018 at 11:21, PGNet Dev <pgnet.dev at gmail.com>
wrote:
> fyi
>
> add'l -- and looks unrelated -- issue
>         /usr/include/pthread.h:251:12: note: previous declaration of
?pthread_join? was here
>          extern int pthread_join (pthread_t __th, void **__thread_return);
What included pthread.h?  That's explicitly not supported by sshd:

$ grep THREAD auth-pam.c
#ifdef USE_POSIX_THREADS
# error "USE_POSIX_THREADS replaced by UNSUPPORTED_POSIX_THREADS_HACK"
 * Formerly known as USE_POSIX_THREADS, using this is completely unsupported
#ifdef UNSUPPORTED_POSIX_THREADS_HACK

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.