Forum OpenACS Development: Re: Naviserver Compilation Error on RHEL 8
Root cause: on OpenSSL 1.1.1 the optional OCSP path was compiled in by mistake because our feature detection was too permissive. Those code paths rely on OpenSSL 3.x The change in [1] tightens the checks and now activates OCSP in 3.x only.
Workaround note: I don’t recommend switching to X509_NAME_hash_old(). That function uses the legacy MD5 name-hash, while OpenSSL 3.x uses SHA-1. If you adopt the old hash now and later upgrade to OpenSSL 3, the directory hashes won’t match and OCSP lookups will misbehave.
I’ll also include this fix in the next NaviServer 5.0.x patch release.
All the best,
-g
[1] https://github.com/naviserver-project/naviserver/commit/c9d75e923c6f7f3550cdfa95ca0bf6fd930e8303
I downloaded install-ns and ran it again and got:
tls.c: In function ‘OCSP_get_cert_id’:
tls.c:753:31: warning: implicit declaration of function ‘X509_NAME_hash_ex’; did you mean ‘X509_NAME_hash_old’? [-Wimplicit-function-declaration]
*selfSignedPtr = (X509_NAME_hash_ex(X509_get_issuer_name(cert), NULL, NULL, NULL)
^~~~~~~~~~~~~~~~~
X509_NAME_hash_old
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o url2file.o url2file.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o urlencode.o urlencode.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o urlopen.o urlopen.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o urlspace.o urlspace.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o uuencode.o uuencode.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o unix.o unix.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o watchdog.o watchdog.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o nswin32.o nswin32.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o tclcrypto.o tclcrypto.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o tclparsefieldvalue.o tclparsefieldvalue.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o main.o main.c
/bin/rm -Rf libnsd.so
gcc -shared -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -O2 -fomit-frame-pointer -L../nsthread -L../nsd -L../nsdb -o libnsd.so adpcmds.o adpeval.o adpparse.o adprequest.o auth.o binder.o cache.o callbacks.o cls.o compress.o config.o conn.o connio.o cookies.o connchan.o crypt.o dlist.o dns.o driver.o dstring.o encoding.o event.o exec.o fastpath.o fd.o filter.o form.o httptime.o index.o info.o init.o limits.o lisp.o listen.o log.o mimetypes.o modload.o nsconf.o nsmain.o nsthread.o op.o pathname.o pidfile.o proc.o progress.o queue.o quotehtml.o random.o range.o request.o return.o returnresp.o rollfile.o sched.o server.o set.o sls.o sock.o sockcallback.o sockfile.o str.o task.o tclcache.o tclcallbacks.o tclcmds.o tclconf.o tclenv.o tclfile.o tclhttp.o tclimg.o tclinit.o tcljob.o tclmisc.o tclobj.o tclobjv.o tclrequest.o tclresp.o tclsched.o tclset.o tclsock.o sockaddr.o tclthread.o tcltime.o tclvar.o tclxkeylist.o tls.o stamp.o url.o url2file.o urlencode.o urlopen.o urlspace.o uuencode.o unix.o watchdog.o nswin32.o tclcrypto.o tclparsefieldvalue.o -lz -lcrypt -lnsthread -L/usr/local/ns/lib -ltcl8.6 -Wl,--export-dynamic -L/usr/local/ns/lib -lssl -lcrypto -Wl,-rpath,:/usr/local/ns/lib
/bin/rm -Rf nsd
gcc -O2 -fomit-frame-pointer -L../nsthread -L../nsd -L../nsdb -o nsd main.o libnsd.so -lz -lcrypt -lnsthread -L/usr/local/ns/lib -ltcl8.6 -Wl,--export-dynamic -L/usr/local/ns/lib -lssl -lcrypto -Wl,-rpath,:/usr/local/ns/lib
libnsd.so: undefined reference to `X509_NAME_hash_ex'
collect2: error: ld returned 1 exit status
make[1]: *** [../include/Makefile.module:162: nsd] Error 1
make[1]: Leaving directory '/usr/local/src/naviserver-5.0.1/nsd'
make: *** [Makefile:34: all] Error 1This time I did not edit any files so I did not replace the _ex with _old in
/usr/local/src/naviserver-5.0.1/nsd/tls.c on Line 752 if statement:
if (selfSignedPtr != NULL) {
*selfSignedPtr = (X509_NAME_hash_ex(X509_get_issuer_name(cert), NULL, NULL, NULL)
== X509_NAME_hash_ex(X509_get_subject_name(cert), NULL, NULL, NULL));
}
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o stamp.o stamp.c
tls.c: In function ‘OCSP_get_cert_id’:
tls.c:753:31: warning: implicit declaration of function ‘X509_NAME_hash_ex’; did you mean ‘X509_NAME_hash_old’? [-Wimplicit-function-declaration]
*selfSignedPtr = (X509_NAME_hash_ex(X509_get_issuer_name(cert), NULL, NULL, NULL)
^~~~~~~~~~~~~~~~~
X509_NAME_hash_old
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o url.o url.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o url2file.o url2file.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o urlencode.o urlencode.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o urlopen.o urlopen.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o urlspace.o urlspace.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o uuencode.o uuencode.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o unix.o unix.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o watchdog.o watchdog.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o nswin32.o nswin32.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o tclcrypto.o tclcrypto.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o tclparsefieldvalue.o tclparsefieldvalue.c
gcc -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-prototyp\
es -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe -DSYSTE\
M_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -c -o main.o main.c
/bin/rm -Rf libnsd.so
gcc -shared -g -O2 -fomit-frame-pointer -Wall -pedantic -Wextra -Wconversion -Wsign-conversion -Wsign-compare -Wwrite-strings -Wdeclaration-after-statement -Wendif-labels -Wshadow -Wmissing-\
prototypes -Wstrict-prototypes -Wno-missing-braces -Wundef -Wunreachable-code -Wswitch-enum -Wpointer-arith -Wold-style-definition -Wmissing-format-attribute -Wformat-security -fPIC -pipe \
-DSYSTEM_MALLOC -std=c99 -I../include -I"/usr/local/ns/include" -DHAVE_CONFIG_H -O2 -fomit-frame-pointer -L../nsthread -L../nsd -L../nsdb -o libnsd.so adpcmds.o adpeval.o adpparse.o ad\
prequest.o auth.o binder.o cache.o callbacks.o cls.o compress.o config.o conn.o connio.o cookies.o connchan.o crypt.o dlist.o dns.o driver.o dstring.o encoding.o event.o exec.o fastpath.o fd.\
o filter.o form.o httptime.o index.o info.o init.o limits.o lisp.o listen.o log.o mimetypes.o modload.o nsconf.o nsmain.o nsthread.o op.o pathname.o pidfile.o proc.o progress.o queue.o quoteh\
tml.o random.o range.o request.o return.o returnresp.o rollfile.o sched.o server.o set.o sls.o sock.o sockcallback.o sockfile.o str.o task.o tclcache.o tclcallbacks.o tclcmds.o tclconf.o tcle\
nv.o tclfile.o tclhttp.o tclimg.o tclinit.o tcljob.o tclmisc.o tclobj.o tclobjv.o tclrequest.o tclresp.o tclsched.o tclset.o tclsock.o sockaddr.o tclthread.o tcltime.o tclvar.o tclxkeylist.o \
tls.o stamp.o url.o url2file.o urlencode.o urlopen.o urlspace.o uuencode.o unix.o watchdog.o nswin32.o tclcrypto.o tclparsefieldvalue.o -lz -lcrypt -lnsthread -L/usr/local/ns/lib -ltcl8.6 \
-Wl,--export-dynamic -L/usr/local/ns/lib -lssl -lcrypto -Wl,-rpath,:/usr/local/ns/lib
/bin/rm -Rf nsd
gcc -O2 -fomit-frame-pointer -L../nsthread -L../nsd -L../nsdb -o nsd main.o libnsd.so -lz -lcrypt -lnsthread -L/usr/local/ns/lib -ltcl8.6 -Wl,--export-dynamic -L/usr/local/ns/lib -lssl -lc\
rypto -Wl,-rpath,:/usr/local/ns/lib
libnsd.so: undefined reference to `X509_NAME_hash_ex'
collect2: error: ld returned 1 exit status
make[1]: *** [../include/Makefile.module:162: nsd] Error 1
make[1]: Leaving directory '/usr/local/src/naviserver-5.0.2/nsd'
make: *** [Makefile:34: all] Error 1
Thank you for your help
if you are using install-ns, specify the verison as in:
sudo version_ns=5.0.3 bash install-ns.sh build
[1] https://github.com/naviserver-project/naviserver/commit/650f47084435f867d3ddc51befbf17320c239900
[2] https://sourceforge.net/projects/naviserver/files/naviserver/5.0.3/
Thank you!