openssh bugs - Nov 2006 - [Bug 1260] Link failure with openssl 0.9.8

http://bugzilla.mindrot.org/show_bug.cgi?id=1260

           Summary: Link failure with openssl 0.9.8
           Product: Portable OpenSSH
           Version: 4.4p1
          Platform: Sparc
        OS/Version: Solaris
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Build system
        AssignedTo: bitbucket at mindrot.org
        ReportedBy: schulz at adi.com


I believe that the following error also occured with earlier versions
of openssh and I just worked around it.  Trying to build openssh 4.4p1
with openssl 0.9.8, I get the following link failure.

Undefined                       first referenced
 symbol                             in file
DSA_generate_parameters             ./libssh.a(key.o)
RSA_generate_key                    ./libssh.a(key.o)
ld: fatal: Symbol referencing errors. No output written to ssh
*** Error code 1

If I revert to openssl 0.9.7, there is no problem.  Checking the
libcrypto.so library with nm, I find that 0.9.8 has
DSA_generate_parameters_ex and RSA_generate_key_ex defined whereas
0.9.7 has DSA_generate_parameters and RSA_generate_key defined.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1260





------- Comment #1 from schulz at adi.com  2006-11-11 09:12 -------
If I follow a hint in the openssl changes file and add
-DOPENSSL_NO_DEPRECATED to the c flags, I get an error much earlier.

cc -O -DOPENSSL_NO_DEPRECATED -I. -I. -I/opt/local/include -I/opt/local
/include  -DSSHDIR=\"/opt/local/etc\" 
-D_PATH_SSH_PROGRAM=\"/opt/local
/bin/ssh\" 
-D_PATH_SSH_ASKPASS_DEFAULT=\"/opt/local/libexec/ssh-askpass
\"  -D_PATH_SFTP_SERVER=\"/opt/local/libexec/sftp-server\" 
  -D_PATH_SSH_KEY_SIGN=\"/opt/local/libexec/ssh-keysign\"
  -D_PATH_SSH_PIDDIR=\"/var/run\" 
-D_PATH_PRIVSEP_CHROOT_DIR=\"/var/em
pty\"  -DSSH_RAND_HELPER=\"/opt/local/libexec/ssh-rand-helper\"
 -DHAVE_CONFIG_H -c kexdhc.c
"kexdhc.c", line 68: improper member use: pub_key
"kexdhc.c", line 113: warning: implicit function declaration: DH_size
"kexdhc.c", line 115: warning: implicit function declaration:
DH_compute_key
"kexdhc.c", line 132: improper member use: pub_key
"kexdhc.c", line 139: warning: implicit function declaration: DH_free
cc: acomp failed for kexdhc.c
*** Error code 2
make: Fatal error: Command failed for target `kexdhc.o'




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1260





------- Comment #2 from dtucker at zip.com.au  2006-11-11 20:21 -------
Where did you put the openssl install, and what configure options did
you use?

I suspect that OpenSSL has converted DSA_generate_parameters and
RSA_generate_key from functions to a compatibility #defines, and that
you have an old version of the headers in your include path somewhere.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1260





------- Comment #3 from schulz at adi.com  2006-11-14 06:08 -------
Openssl 0.9.8d was built as follows:

./Configure shared --prefix=/opt/local enable-rc5 enable-mdc2
zlib-dynamic -DOPENSSL_NO_DEPRECATED -I/opt/local/include
-R/opt/local/lib solaris-sparcv7-cc

Ah!  I expect that you need it to be built without the
'-DOPENSSL_NO_DEPRECATED'.  I will try that and see if that helps.
There are compatibility versons of those functions in
crypto/dsa/dsa_depr.c and crypto/rsa/rsa_depr.c in the openssl source.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1260





------- Comment #4 from schulz at adi.com  2006-11-14 09:06 -------
Rebuilding Openssl 0.9.8d without '-DOPENSSL_NO_DEPRECATED'
fixed the undefined symbol problem.  Note that the Openssl 0.9.7
build was also done with '-DOPENSSL_NO_DEPRECATED'.  Perhaps
DSA_generate_parameters and RSA_generate_key were not deprecated
in that version.
Your call as to whether this is a bug or not.  The Openssl people do
suggest building with '-DOPENSSL_NO_DEPRECATED' defined.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.