openssh bugs - Feb 2025 - [Bug 3794] New: libcrux_mlkem768_sha3.h: undefined reference to htole64 and le64toh when compiling since 9.9p2

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

            Bug ID: 3794
           Summary: libcrux_mlkem768_sha3.h: undefined reference to
                    htole64 and le64toh when compiling since 9.9p2
           Product: Portable OpenSSH
           Version: 9.9p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: Build system
          Assignee: unassigned-bugs at mindrot.org
          Reporter: jordy.provost at beemotechnologie.com

Hi,

So far i was able to compile OpenSSH until 9.9p1.

Since 9.9p2, i have this error:

/bin/gcc -std=gnu11 -o ssh-keygen ssh-keygen.o sshsig.o ssh-sk-client.o
-L. -Lopenbsd-compat/  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack
-Wl,-z,retpolineplt -fstack-protector-all -pie  -lssh -lopenbsd-compat
-lresolv -lrt -ldl -lutil  -lcrypto  -lz
collect2: erreur: ld a retourn? 1 code d'?tat d'ex?cution
make: *** [ssh] Erreur 1
make: *** Attente des t?ches non termin?es....
./libssh.a(kexmlkem768x25519.o): In function
`core_num__u64_9__to_le_bytes':
/root/openssh-9.9p2/libcrux_mlkem768_sha3.h:164: undefined reference to
`htole64'
./libssh.a(kexmlkem768x25519.o): In function
`core_num__u64_9__from_le_bytes':
/root/openssh-9.9p2/libcrux_mlkem768_sha3.h:170: undefined reference to
`le64toh'
collect2: erreur: ld a retourn? 1 code d'?tat d'ex?cution
make: *** [sshd-session] Erreur 1

If a revert the commit 26d81a430811672bc762687166986cad40d28cc0 on
9.9p2 sources, i am able to compile again.

The system is Little-Endian:

# printf '\1' | od -dAn
1

P.S: the tagged version for this issue is (incorrectly) 9.9p1 as the
select box on bugzilla does not give 9.9p2 option.


THanks in advance.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

Jordy Provost <jordy.provost at beemotechnologie.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P5                          |P3
           Severity|enhancement                 |normal

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|9.9p1                       |9.9p2
                 CC|                            |dtucker at dtucker.net

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

--- Comment #1 from Darren Tucker <dtucker at dtucker.net> ---
What tree is that commit ID from?  It might just be insufficient
coffee, but I don't see that in the Portable OpenSSH tree.

Also can you describe your system some more?  We test on a wide variety
of littlendian linux flavours so we'll need a lot more information to
narrow it down or reproduce it.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

--- Comment #2 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to Jordy Provost from comment #0)
> P.S: the tagged version for this issue is (incorrectly) 9.9p1 as the
> select box on bugzilla does not give 9.9p2 option.
Thanks for pointing this out.  We hadn't added it yet, fixed and
updated this bug.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

--- Comment #3 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to Jordy Provost from comment #0)
> If a revert the commit 26d81a430811672bc762687166986cad40d28cc0 on
> 9.9p2 sources, i am able to compile again.
Ah, that's the upstream commit ID not the portable tree ID:

commit 11f348196b3fb51c3d8d1f4f36db9d73f03149ed
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Sun Oct 27 02:06:01 2024 +0000

    upstream: fix ML-KEM768x25519 KEX on big-endian systems; spotted by

    jsg@ feedback/ok deraadt@

    OpenBSD-Commit-ID: 26d81a430811672bc762687166986cad40d28cc0

le64toh should be in endian.h.  Do you have endian.h?  Is HAVE_ENDIAN_H
in config.h?  If not it should be defined in defines.h.

The only scenario I can see that results in that error is that you do
have endian.h but it does not define le64toh?

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

--- Comment #4 from Jordy Provost <jordy.provost at beemotechnologie.com>
---
Thank you for your answer.

Im am not a developer so sorry if i am struggling to answer correctly
or give you required informations smoothly, but i will try at best.

I have downloaded OpenSSH sources 9.9p2 here:
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.9p2.tar.gz
I have found the commit and download the patch here in order to reverse
it:
https://github.com/openssh/openssh-portable/commit/cf3e48ee8ba1beeccddd2f203b558fa102be67a2

I have indicated the "OpenBSD-Commit-ID" found on this Github page.
My mistake, it was not coffee :)

My systems are something based on a very old one, we plan to update
them but it is a very big job, and it will probably takes months at
least, so we need to maintain, and we have a lot of them.

Obviously, i don't request you to make archeology, but since i was able
to compile until 9.9p1 i wanted to report if maybe:
- you could do something, if not to costly on your side
- the issue was not correlated to the age of the system (looks like we
are not on this case)

But if things are too complicated, just to support an old system, i
will be annoyed albeit completely understanding.

The system is based on Debian Lenny with some upgraded parts.
The glibc version on the system is 2.7.
I am using gcc 4.8.4.

I have found endian.h here:
- /usr/include/bits/endian.h
- /usr/include/endian.h

I don't see any occurrence of le64toh in theses files, so in my (pretty
low) understanding, it seems you are right.

I let you see if it is worth considering a fix to handle this case.

Regards,

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

--- Comment #5 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to Jordy Provost from comment #4)
[...]
> My systems are something based on a very old one, we plan to update
> them but it is a very big job, and it will probably takes months at
> least, so we need to maintain, and we have a lot of them.
> 
> Obviously, i don't request you to make archeology,
As my fellow maintainers will likely attest, I am not above a bit of
system archaeology :-)
> I have found endian.h here:
> - /usr/include/bits/endian.h
> - /usr/include/endian.h
> 
> I don't see any occurrence of le64toh in theses files, so in my
> (pretty low) understanding, it seems you are right.
The current versions of the specs says <endian.h> is supposed to have
le64toh and htole64 but perhaps yours predates that version of the
spec.

In any case, I don't think it's very hard to make this work, it just
needs those macros/functions checked individually.  I'll attach a patch
for this shortly.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

--- Comment #6 from Jordy Provost <jordy.provost at beemotechnologie.com>
---
Great, thank you very much !
Don't hesitate if you need some more information.
I will test the patch(In reply to Darren Tucker from comment
#5)
> (In reply to Jordy Provost from comment #4)
> [...]
> > My systems are something based on a very old one, we plan to update
> > them but it is a very big job, and it will probably takes months at
> > least, so we need to maintain, and we have a lot of them.
> > 
> > Obviously, i don't request you to make archeology,
> 
> As my fellow maintainers will likely attest, I am not above a bit of
> system archaeology :-)
> 
> > I have found endian.h here:
> > - /usr/include/bits/endian.h
> > - /usr/include/endian.h
> > 
> > I don't see any occurrence of le64toh in theses files, so in my
> > (pretty low) understanding, it seems you are right.
> 
> The current versions of the specs says <endian.h> is supposed to
> have le64toh and htole64 but perhaps yours predates that version of
> the spec.
> 
> In any case, I don't think it's very hard to make this work, it
just
> needs those macros/functions checked individually.  I'll attach a
> patch for this shortly.
Thank you very much !
Don't hesitate if you need more information.
I am obviously available to test the patch as soon as possible, but
there is no emergency on my side as i have found a way to compile the
last version.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

--- Comment #7 from Darren Tucker <dtucker at dtucker.net> ---
Created attachment 3863
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3863&action=edit
Split out htole64 and friends

Please try this patch.  It should apply on top of 9.9p2.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

--- Comment #8 from Jordy Provost <jordy.provost at beemotechnologie.com>
---
Thank you for the patch !

I have applied it to the 9.9p2 sources:

# patch -p1 < ./split_out_htole64_and_friends.patch
patching file config.h.in
patching file configure
patching file configure.ac
patching file defines.h

And now it compiles without error.

For good measure, i have installed the newly compiled OpenSSH, i can
connect to the machine and use the client to connect to others.

So seems good for me, unless you want me to test other things ?

Regards,

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org
   Attachment #3863|                            |ok+
              Flags|                            |

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
             Blocks|                            |3740
         Resolution|---                         |FIXED

--- Comment #9 from Darren Tucker <dtucker at dtucker.net> ---
That's sufficient, thanks.  I have applied the patch and it will be in
the next release.  Thanks for the report.


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=3740
[Bug 3740] Tracking bug for OpenSSH 10.0
-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3794

--- Comment #10 from Jordy Provost <jordy.provost at beemotechnologie.com>
---
Thank you for your time, your willingness to fix things for old
systems, the patch you provided, your quick answers, and all the work
you make for OpenSSH !

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.