openssh bugs - Feb 2024 - [Bug 3668] New: OpenSSL version header not found

https://bugzilla.mindrot.org/show_bug.cgi?id=3668

            Bug ID: 3668
           Summary: OpenSSL version header not found
           Product: Portable OpenSSH
           Version: 9.6p1
          Hardware: ix86
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Build system
          Assignee: unassigned-bugs at mindrot.org
          Reporter: fatcharly at gmx.de

Created attachment 3790
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3790&action=edit
config.log

Hi,

I'm trying to compile an openssh 9.6p1 with an openssl 3.0.13.
I get this error:
...
checking for openssl... /usr/bin/openssl
checking for openssl/opensslv.h... yes
checking OpenSSL header version... not found
configure: error: OpenSSL version header not found.

I compile with this configure command:
./configure --prefix=/opt/openssh
--includedir=/opt/openssl/include/openssl --with-ssl-dir=/opt/openssl
--with-xauth=/usr/bin/xauth --with-zlib=/opt/zlib

The file openssl.v is present under /opt/openssl/include/openssl 

This error also happends with the newest openssl 3.2.1 

I attach the config.log

best regards

fatcharly

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3668

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #1 from Damien Miller <djm at mindrot.org> ---
This error message is near the end of config.log:
> ./conftest: error while loading shared libraries: libcrypto.so.3: cannot
open shared object file: No such file or directory
It looks like your OpenSSL is either not properly installed or your
configure options don't properly specify the path to the libraries.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3668

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net

--- Comment #2 from Darren Tucker <dtucker at dtucker.net> ---
You can get configure to tell the linker to set a dynamic runtime path.
 We do this in the CI tests on Ubuntu:

./configure --with-ssl-dir=/opt/openssl --with-rpath=-Wl,-rpath,

(note that in this example, the trailing comma is significant.)

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3668

--- Comment #3 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to fatcharly from comment #0)
[...]
> checking OpenSSL header version... not found
> configure: error: OpenSSL version header not found.

(In reply to Damien Miller from comment #1)
> > ./conftest: error while loading shared libraries: libcrypto.so.3:
cannot open shared object file: No such file or directory
Given what the actual failure was, the message was a bit misleading. 
I'm not sure what would be an improvement, though.  "compiling OpenSSL
version header test program" ?

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3668

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3791|                            |ok?(djm at mindrot.org)
              Flags|                            |

--- Comment #4 from Darren Tucker <dtucker at dtucker.net> ---
Created attachment 3791
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3791&action=edit
improve (?) openssl header check error message

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3668

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3791|ok?(djm at mindrot.org)        |ok+
              Flags|                            |

--- Comment #5 from Damien Miller <djm at mindrot.org> ---
Comment on attachment 3791
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3791
improve (?) openssl header check error message

I can't think of a better wording

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3668

--- Comment #6 from fatcharly at gmx.de ---
Hi,
before I compile the open ssl with "make install", I do a "make
test",
and this takes long but its all ok.

So, I run this:

./configure --with-ssl-dir=/opt/openssl --with-rpath=-Wl,-rpath,

and send you the log again ?

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3668

--- Comment #7 from fatcharly at gmx.de ---
I just checked to be sure:

[root at pia opt]# find /opt/openssl -name libcrypto.so.3
/opt/openssl/lib/libcrypto.so.3

It's where it is supposed to be.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3668

--- Comment #8 from fatcharly at gmx.de ---
Result of: ./configure --with-ssl-dir=/opt/openssl
--with-rpath=-Wl,-rpath,

OpenSSH has been configured with the following options:
                     User binaries: /usr/local/bin
                   System binaries: /usr/local/sbin
               Configuration files: /usr/local/etc
                   Askpass program: /usr/local/libexec/ssh-askpass
                      Manual pages: /usr/local/share/man/manX
                          PID file: /var/run
  Privilege separation chroot path: /var/empty
            sshd default user PATH:
/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
                    Manpage format: doc
                       PAM support: no
                   OSF SIA support: no
                 KerberosV support: no
                   SELinux support: no
                   libedit support: no
                   libldns support: no
  Solaris process contract support: no
           Solaris project support: no
         Solaris privilege support: no
       IP address in $DISPLAY hack: no
           Translate v4 in v6 hack: yes
                  BSD Auth support: no
              Random number source: OpenSSL internal ONLY
             Privsep sandbox style: none
                   PKCS#11 support: yes
                  U2F/FIDO support: yes

              Host: i686-pc-linux-gnu
          Compiler: cc -std=gnu99
    Compiler flags: -g -O2 -pipe -Wall -Wextra -Wpointer-arith
-Wuninitialized -Wsign-compare -Wformat-security -Wno-pointer-sign
-Wno-un                          used-parameter -fno-strict-aliasing
-D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-all
-fPIE
Preprocessor flags: -I/opt/openssl/include  -D_XOPEN_SOURCE=600
-D_BSD_SOURCE -D_DEFAULT_SOURCE -D_GNU_SOURCE
-DOPENSSL_API_COMPAT=0x1010                          0000L
      Linker flags: -L/opt/openssl/lib -Wl,-rpath,/opt/openssl/lib 
-Wl,-z,retpolineplt -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -fstac  
                       k-protector-all -pie
         Libraries: -lresolv -lrt -ldl -lutil
     +for channels: -lcrypto  -lz
         +for sshd: -lcrypt

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3668

--- Comment #9 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to fatcharly from comment #6)
> Hi,
> before I compile the open ssl with "make install", I do a
"make
> test", and this takes long but its all ok.
> 
> So, I run this:
> 
> ./configure --with-ssl-dir=/opt/openssl --with-rpath=-Wl,-rpath,
yes.
> and send you the log again ?
Nope, if it works (which based on comment#8, it did) then all you need
to do now is run "make" and if that succeeds then you're good to
go.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3668

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WORKSFORME
             Status|NEW                         |RESOLVED

--- Comment #10 from Darren Tucker <dtucker at dtucker.net> ---
Your comment#8 indicates the problem you reported has been resolved.
Please reopen if that is not the case.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.