[Issue 10039] New: configure fails to detect SSL_export_keying_material_early with LibreSSL

List overview All Threads
Download

newer

older

[Issue 9993] New: Potential race...

[Issue 9995] New: Potential memory...

openldap-its＠openldap.org

9 Apr 2023 9 Apr '23

3:33 p.m.

https://bugs.openldap.org/show_bug.cgi?id=10039

Issue ID: 10039 Summary: configure fails to detect SSL_export_keying_material_early with LibreSSL Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: build Assignee: bugs@openldap.org Reporter: orbea@riseup.net Target Milestone: ---

Created attachment 957 --> https://bugs.openldap.org/attachment.cgi?id=957&action=edit config.log

When configuring OpenLDAP using --with-tls=openssl with LibreSSL the configure will fail to detect SSL_export_keying_material_early since LibreSSL doesn't support this function yet. However OpenLDAP doesn't actually use this function so this can be easily solved by checking for SSL_library_init which is a more standard function which both OpenSSL and LibreSSL support which OpenLDAP actually uses in libraries/libldap/tls_o.c.

checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_export_keying_material_early in -lssl... no configure: error: Could not locate TLS/SSL package

Other than this the build succeeds correctly with at least LibreSSL 3.7.

-- You are receiving this mail because: You are on the CC list for the issue.

Show replies by date

openldap-its＠openldap.org

9 Apr 9 Apr

3:34 p.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

--- Comment #1 from orbea@riseup.net --- Created attachment 958 --> https://bugs.openldap.org/attachment.cgi?id=958&action=edit Build fix patch

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

11:27 p.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

Howard Chu hyc@openldap.org changed:

--- Comment #2 from Howard Chu hyc@openldap.org --- No. This was changed explicitly to prevent use of older OpenSSL APIs. See ITS#9640.

Closing this ITS.

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

10 Apr 10 Apr

7:17 a.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

--- Comment #3 from orbea@riseup.net --- I made an LibreSSL issue.

https://git.openldap.org/openldap/openldap/-/merge_requests/612

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

7:18 a.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

Quanah Gibson-Mount quanah@openldap.org changed:

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

11:30 a.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

--- Comment #4 from orbea@riseup.net --- @Howard Chu

Would using SSL_CTX_set_ciphersuites() be an acceptable compromise as suggested in the LibreSSL issue?

https://github.com/libressl/portable/issues/836#issuecomment-1502095024

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

11 Apr 11 Apr

4:41 a.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

Ondřej Kuzník ondra@mistotebe.net changed:

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

12 Apr 12 Apr

2:30 a.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

Ondřej Kuzník ondra@mistotebe.net changed:

--- Comment #5 from Ondřej Kuzník ondra@mistotebe.net --- Hi, thanks for letting us know, this might work to allow linking against libressl. Assuming their API is sufficiently close to OpenSSL's in how OpenLDAP uses it to actually work: we have to take your word for it that it does. Also we haven't seen anyone stepping up to maintain this combination so far, even if we accept your patch, be advised it might still bitrot without ongoing care.

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

6:46 a.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

--- Comment #6 from orbea@riseup.net --- Of course, in the event OpenLDAP starts using functionality which works in OpenSSL, but not LiberSSL I will report it to OpenBSD. They also use OpenLDAP so they will have direct incentive to fix it. Although I can understand they do not currently have plans to implement SSL_export_keying_material() when there do not seem to be many users of this function while there are other functions projects other than OpenLDAP could benefit from having. The last few releases LibreSSL has made significant progress in bridging the gap with OpenSSL and hopefully that trend will continue.

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

6:59 a.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

--- Comment #7 from Ondřej Kuzník ondra@mistotebe.net --- On Wed, Apr 12, 2023 at 01:46:54PM +0000, openldap-its@openldap.org wrote:

...

Of course, in the event OpenLDAP starts using functionality which works in OpenSSL, but not LiberSSL I will report it to OpenBSD. They also use OpenLDAP so they will have direct incentive to fix it. Although I can understand they do not currently have plans to implement SSL_export_keying_material() when there do not seem to be many users of this function while there are other functions projects other than OpenLDAP could benefit from having. The last few releases LibreSSL has made significant progress in bridging the gap with OpenSSL and hopefully that trend will continue.

If you've satisfied yourself that it works in your workloads (whatever you need over what the test suite exercises already), I'd say feel free to update and reopen your merge request.

Regards,

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

1:55 p.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

--- Comment #8 from orbea@riseup.net --- Created attachment 960 --> https://bugs.openldap.org/attachment.cgi?id=960&action=edit OpenLDAP successful build log with LibreSSL 3.6.2

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

1:55 p.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

--- Comment #9 from orbea@riseup.net --- Created attachment 961 --> https://bugs.openldap.org/attachment.cgi?id=961&action=edit OpenLDAP successful build log with LibreSSL 3.7.2

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

1:55 p.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

--- Comment #10 from orbea@riseup.net --- Created attachment 962 --> https://bugs.openldap.org/attachment.cgi?id=962&action=edit OpenLDAP current git successful build log with LibreSSL 3.6.2

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

1:56 p.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

orbea@riseup.net changed:

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

1:56 p.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

orbea@riseup.net changed:

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

1:57 p.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

orbea@riseup.net changed:

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

1:58 p.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

--- Comment #11 from orbea@riseup.net --- I attached 3 build logs with the tests showing that current LibreSSL versions can build OpenLDAP on Gentoo as I have claimed. I will open a new MR next.

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

16 May 16 May

9:12 a.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

Quanah Gibson-Mount quanah@openldap.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |2.5.15

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

9:12 a.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

Quanah Gibson-Mount quanah@openldap.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Assignee|bugs@openldap.org |hyc@openldap.org

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

9:12 a.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

Quanah Gibson-Mount quanah@openldap.org changed:

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

10:03 a.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

Quanah Gibson-Mount quanah@openldap.org changed:

--- Comment #12 from Quanah Gibson-Mount quanah@openldap.org --- head:

• cb73e60a by orbea at 2023-05-15T19:17:51+00:00 ITS#10039 Test for SSL_CTX_set_ciphersuites()

RE26:

• cd2a914b by orbea at 2023-05-16T16:22:48+00:00 ITS#10039 Test for SSL_CTX_set_ciphersuites()

RE25:

• 9701abb4 by orbea at 2023-05-16T16:55:17+00:00 ITS#10039 Test for SSL_CTX_set_ciphersuites()

-- You are receiving this mail because: You are on the CC list for the issue.

openldap-its＠openldap.org

10 Jul 10 Jul

2:08 p.m.

New subject: [Issue 10039] configure fails to detect SSL_export_keying_material_early with LibreSSL

https://bugs.openldap.org/show_bug.cgi?id=10039

Quanah Gibson-Mount quanah@openldap.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |VERIFIED

-- You are receiving this mail because: You are on the CC list for the issue.

501

Age (days ago)

593

Last active (days ago)

openldap-bugs@openldap.org

21 comments

1 participants

tags (0)

participants (1)

openldap-its＠openldap.org