configure: error: Your LibreSSL headers do not match your library.

[izyboyd]

I'm helping someone who has an ancient version of OpenSMTPD from 2017 with major security vulnerabilities running on Fedora 25. We're working on upgrading the entire environment, but until then, I'd like to just get OpenSMTPD >= 6.6.4 compiled on to the box to replace the vulnerable version.

First, I ran ./configure (with openssl-devel 1.0.2m-1.fc25 installed that was used to compile the older version), but make had errors such as:

../../smtpd/ca.c:438:10: error: called object is not a function or function pointer
../../smtpd/ca.c: In function ‘rsae_pub_dec’:
../../smtpd/ca.c:446:10: warning: implicit declaration of function ‘RSA_meth_get_pub_dec’ [-Wimplicit-function-declaration]
  return (RSA_meth_get_pub_dec(rsa_default)(flen, from, to, rsa, padding));

Next, I downloaded and compiled LibreSSL into /usr/local but configuring OpenSMTPD leads to the error in the title of this issue:

./configure --with-path-CAfile=/etc/pki/tls/cert.pem --with-libssl=/usr/local/

$ ./configure --with-path-CAfile=/etc/pki/tls/cert.pem --with-libssl=/usr/local/
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking how to print strings... printf
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking for a sed that does not truncate output... /usr/bin/sed
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for fgrep... /usr/bin/grep -F
checking for ld used by gcc... /usr/bin/ld
checking if the linker (/usr/bin/ld) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... yes
checking the maximum length of command line arguments... 1572864
checking how to convert x86_64-pc-linux-gnu file names to x86_64-pc-linux-gnu format... func_convert_file_noop
checking how to convert x86_64-pc-linux-gnu file names to toolchain format... func_convert_file_noop
checking for /usr/bin/ld option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for ar... ar
checking for archiver @FILE support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from gcc object... ok
checking for sysroot... no
checking for a working dd... /usr/bin/dd
checking how to truncate binary pipes... /usr/bin/dd bs=4096 count=1
checking for mt... no
checking if : is a manifest tool... no
checking how to run the C preprocessor... gcc -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if gcc supports -fno-rtti -fno-exceptions... no
checking for gcc option to produce PIC... -fPIC -DPIC
checking if gcc PIC flag -fPIC -DPIC works... yes
checking if gcc static flag -static works... no
checking if gcc supports -c -o file.o... yes
checking if gcc supports -c -o file.o... (cached) yes
checking whether the gcc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking whether -lc should be explicitly linked in... no
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
checking for gcc... (cached) gcc
checking whether we are using the GNU C compiler... (cached) yes
checking whether gcc accepts -g... (cached) yes
checking for gcc option to accept ISO C89... (cached) none needed
checking whether gcc understands -c and -o together... (cached) yes
checking whether byte ordering is bigendian... no
checking how to run the C preprocessor... gcc -E
checking for ar... /usr/bin/ar
checking for cat... /usr/bin/cat
checking for chmod... /usr/bin/chmod
checking for chown... /usr/bin/chown
checking for zcat... /usr/bin/zcat
checking for sed... (cached) /usr/bin/sed
checking for bash... /usr/bin/bash
checking for ksh... (cached) /usr/bin/bash
checking for sh... (cached) /usr/bin/bash
checking for sh... /usr/bin/sh
checking for groff... /usr/bin/groff
checking for nroff... /usr/bin/nroff
checking for mandoc... no
checking for bison... bison -y
checking arpa/nameser_compat.h usability... yes
checking arpa/nameser_compat.h presence... yes
checking for arpa/nameser_compat.h... yes
checking crypt.h usability... yes
checking crypt.h presence... yes
checking for crypt.h... yes
checking dirent.h usability... yes
checking dirent.h presence... yes
checking for dirent.h... yes
checking err.h usability... yes
checking err.h presence... yes
checking for err.h... yes
checking fcntl.h usability... yes
checking fcntl.h presence... yes
checking for fcntl.h... yes
checking getopt.h usability... yes
checking getopt.h presence... yes
checking for getopt.h... yes
checking grp.h usability... yes
checking grp.h presence... yes
checking for grp.h... yes
checking libgen.h usability... yes
checking libgen.h presence... yes
checking for libgen.h... yes
checking limits.h usability... yes
checking limits.h presence... yes
checking for limits.h... yes
checking maillock.h usability... no
checking maillock.h presence... no
checking for maillock.h... no
checking mach/mach_time.h usability... no
checking mach/mach_time.h presence... no
checking for mach/mach_time.h... no
checking ndir.h usability... no
checking ndir.h presence... no
checking for ndir.h... no
checking netdb.h usability... yes
checking netdb.h presence... yes
checking for netdb.h... yes
checking pam/pam_appl.h usability... no
checking pam/pam_appl.h presence... no
checking for pam/pam_appl.h... no
checking paths.h usability... yes
checking paths.h presence... yes
checking for paths.h... yes
checking security/pam_appl.h usability... yes
checking security/pam_appl.h presence... yes
checking for security/pam_appl.h... yes
checking shadow.h usability... yes
checking shadow.h presence... yes
checking for shadow.h... yes
checking sys/cdefs.h usability... yes
checking sys/cdefs.h presence... yes
checking for sys/cdefs.h... yes
checking sys/dir.h usability... yes
checking sys/dir.h presence... yes
checking for sys/dir.h... yes
checking sys/file.h usability... yes
checking sys/file.h presence... yes
checking for sys/file.h... yes
checking sys/mount.h usability... yes
checking sys/mount.h presence... yes
checking for sys/mount.h... yes
checking sys/ndir.h usability... no
checking sys/ndir.h presence... no
checking for sys/ndir.h... no
checking sys/pstat.h usability... no
checking sys/pstat.h presence... no
checking for sys/pstat.h... no
checking sys/statfs.h usability... yes
checking sys/statfs.h presence... yes
checking for sys/statfs.h... yes
checking sys/time.h usability... yes
checking sys/time.h presence... yes
checking for sys/time.h... yes
checking sys/un.h usability... yes
checking sys/un.h presence... yes
checking for sys/un.h... yes
checking time.h usability... yes
checking time.h presence... yes
checking for time.h... yes
checking ucred.h usability... no
checking ucred.h presence... no
checking for ucred.h... no
checking util.h usability... no
checking util.h presence... no
checking for util.h... no
checking vis.h usability... no
checking vis.h presence... no
checking for vis.h... no
checking for login_cap.h... no
checking for sys/mount.h... (cached) yes
checking bsd/libutil.h usability... no
checking bsd/libutil.h presence... no
checking for bsd/libutil.h... no
checking libutil.h usability... no
checking libutil.h presence... no
checking for libutil.h... no
checking for fts.h... yes
checking for asr.h... yes
checking for long long... yes
checking for unsigned long long... yes
checking for long double... yes
checking for u_int... yes
checking for u_char... yes
checking size of short int... 2
checking size of int... 4
checking size of long int... 8
checking size of long long int... 8
checking for int8_t... yes
checking for int16_t... yes
checking for int32_t... yes
checking for int64_t... yes
checking for uint8_t... yes
checking for uint16_t... yes
checking for uint32_t... yes
checking for uint64_t... yes
checking for intptr_t... yes
checking for unsigned long long int... yes
checking for long long int... yes
checking for intmax_t... yes
checking for uintptr_t... yes
checking for uintmax_t... yes
checking for size_t... yes
checking for ssize_t... yes
checking for off_t... yes
checking for mode_t... yes
checking for pid_t... yes
checking for uid_t in sys/types.h... yes
checking for socklen_t... yes
checking for sig_atomic_t... yes
checking for fsblkcnt_t... yes
checking for fsfilcnt_t... yes
checking for in_addr_t... yes
checking for in_port_t... yes
checking for sa_family_t... yes
checking for struct timespec... yes
checking for struct ifgroupreq... no
checking for struct sockaddr_storage... yes
checking for struct sockaddr_in6... yes
checking for struct in6_addr... yes
checking for struct addrinfo... yes
checking for struct timeval... yes
checking whether LLONG_MAX is declared... yes
checking for struct sockaddr_in6.sin6_scope_id... yes
checking for struct passwd.pw_gecos... yes
checking for struct passwd.pw_class... no
checking for struct passwd.pw_change... no
checking for struct passwd.pw_expire... no
checking for struct stat.st_flags... no
checking for struct stat.st_mtim... yes
checking for struct stat.st_mtimespec... no
checking for struct sockaddr.sa_len... no
checking for struct sockaddr_storage.ss_len... no
checking for struct sockaddr_in.sin_len... no
checking for struct sockaddr_in6.sin6_len... no
checking for struct statfs.f_favail... no
checking for struct sockaddr_storage.ss_family... yes
checking for struct sockaddr_storage.__ss_family... no
checking for struct tm.tm_gmtoff... yes
checking for struct tm.tm_zone... yes
checking for struct DIR.d_type... no
checking whether O_NONBLOCK is declared... yes
checking whether AF_LOCAL is declared... yes
checking whether PF_LOCAL is declared... yes
checking whether IPPORT_HILASTAUTO is declared... no
checking whether WAIT_MYPGRP is declared... yes
checking whether writev is declared... yes
checking whether LOG_PERROR is declared... yes
checking for inline... inline
checking for library containing basename... none required
checking for library containing closefrom... no
checking for library containing fmt_scaled... no
checking for library containing dirname... none required
checking for library containing inet_net_pton... -lresolv
checking for library containing clock_gettime... none required
checking for library containing fts_open... none required
checking for library containing daemon... none required
checking for library containing fparseln... no
checking for library containing res_hnok... no
checking for library containing res_randomid... no
checking for library containing res_9_b64_ntop... no
checking for library containing __b64_pton... none required
checking for library containing b64_pton... no
checking for library containing __b64_ntop... none required
checking for library containing b64_ntop... no
checking for library containing setsockopt... none required
checking for library containing crypt... -lcrypt
checking for library containing imsg_init... no
checking for library containing event_asr_run... no
checking for asprintf... yes
checking for arc4random... no
checking for bcopy... yes
checking for calloc_conceal... no
checking for chflags... no
checking for crypt_checkpass... no
checking for dirfd... yes
checking for err... yes
checking for errc... no
checking for errx... yes
checking for explicit_bzero... no
checking for fchflags... no
checking for fgetln... no
checking for flock... yes
checking for freeaddrinfo... yes
checking for freezero... no
checking for getaddrinfo... yes
checking for getdtablesize... yes
checking for getdtablecount... no
checking for getline... yes
checking for getnameinfo... yes
checking for gettimeofday... yes
checking for getopt... yes
checking for getpeereid... no
checking for getpeerucred... no
checking for getspnam... yes
checking for inet_aton... yes
checking for inet_ntoa... yes
checking for inet_ntop... yes
checking for malloc_conceal... no
checking for memmove... yes
checking for nanosleep... yes
checking for nsleep... no
checking for pipe2... yes
checking for pidfile... no
checking for pledge... no
checking for reallocarray... no
checking for recallocarray... no
checking for res_hnok... no
checking for res_randomid... no
checking for setenv... yes
checking for seteuid... yes
checking for setegid... yes
checking for setproctitle... no
checking for setregid... yes
checking for setreuid... yes
checking for setresuid... yes
checking for setresgid... yes
checking for setsid... yes
checking for signal... yes
checking for sigaction... yes
checking for snprintf... yes
checking for socketpair... yes
checking for strdup... yes
checking for strerror... yes
checking for strlcat... no
checking for strlcpy... no
checking for strmode... no
checking for strndup... yes
checking for strnlen... yes
checking for strnvis... no
checking for strtonum... no
checking for sysconf... yes
checking for tcgetpgrp... yes
checking for time... yes
checking for usleep... yes
checking for vasprintf... yes
checking for vsnprintf... yes
checking for waitpid... yes
checking for warn... yes
checking for warnx... yes
checking whether strsep is declared... yes
checking for strsep... yes
checking whether strlcat is declared... no
checking whether strlcpy is declared... no
checking for /proc/pid/fd directory... yes
checking if gcc supports compile flag -Qunused-arguments... no
checking if gcc supports compile flag -Wunknown-warning-option... no
checking if gcc supports compile flag -Wall... yes
checking if gcc supports compile flag -Wpointer-arith... yes
checking if gcc supports compile flag -Wuninitialized... yes
checking if gcc supports compile flag -Wsign-compare... yes
checking if gcc supports compile flag -Wformat-security... yes
checking if gcc supports compile flag -Wsizeof-pointer-memaccess... yes
checking if gcc supports compile flag -Wpointer-sign... yes
checking if gcc supports compile flag -Wunused-result... yes
checking if gcc supports compile flag -fno-strict-aliasing... yes
checking gcc version... 6.4.1
checking if gcc accepts -fno-builtin-memset... yes
checking if compiler allows __attribute__ on return types... yes
checking compiler and flags for sanity... yes
checking whether system supports SO_PEERCRED getsockopt... yes
checking for nroff... (cached) /usr/bin/nroff
checking system mail directory... /var/mail from _PATH_MAILDIR
checking system pid directory... /var/run/ from paths.h
checking for msg_accrights field in struct msghdr... no
checking for msg_control field in struct msghdr... yes
checking if libc defines __progname... yes
checking whether gcc implements __FUNCTION__... yes
checking whether gcc implements __func__... yes
checking whether va_copy exists... yes
checking whether __va_copy exists... yes
checking whether getopt has optreset support... no
checking for event.h... yes
checking if programs using libevent functions will link... yes
checking whether SSL_CTX_use_certificate_chain_mem is available... yes
checking whether ECDSA is available... yes
checking whether LibreSSL's headers match the library... no
configure: error: Your LibreSSL headers do not match your library.

$ ls /usr/local/include/openssl/ /usr/local/lib/libssl*
/usr/local/lib/libssl.a  /usr/local/lib/libssl.la  /usr/local/lib/libssl.so  /usr/local/lib/libssl.so.48  /usr/local/lib/libssl.so.48.0.1

/usr/local/include/openssl/:
aes.h    blowfish.h  cast.h    comp.h      curve25519.h  dso.h    ec.h      gost.h  lhash.h  objects.h      opensslfeatures.h  pem.h       rand.h    rsa.h        sm4.h    ssl3.h   ts.h         whrlpool.h     x509_vfy.h
asn1.h   bn.h        chacha.h  conf_api.h  des.h         dtls1.h  engine.h  hkdf.h  md4.h    obj_mac.h      opensslv.h         pkcs12.h    rc2.h     safestack.h  srtp.h   ssl.h    txt_db.h     x509.h
asn1t.h  buffer.h    cmac.h    conf.h      dh.h          ecdh.h   err.h     hmac.h  md5.h    ocsp.h         ossl_typ.h         pkcs7.h     rc4.h     sha.h        ssl23.h  stack.h  ui_compat.h  x509v3.h
bio.h    camellia.h  cms.h     crypto.h    dsa.h         ecdsa.h  evp.h     idea.h  modes.h  opensslconf.h  pem2.h             poly1305.h  ripemd.h  sm3.h        ssl2.h   tls1.h   ui.h         x509_verify.h

[reuleaux]

I get the same error ("configure: error: Your LibreSSL headers do not match your library.") - so in that sense I cannot help - sorry - but only confirm your error.

I did however roughly follow the steps of
https://pieterhollander.nl/post/install-opensmtpd-debian/
This blog was a while ago, so the libressl / opensmtpd versions used there are outdated - but I took some inspirations
from this blog post nevertheless: I did adjust the configure command to include LDFLAGS and CFLAGS:

LDFLAGS="-L/opt/libressl/lib" CFLAGS="-I/opt/libressl/include" ./configure \
    --with-gnu-ld \
    ...
    --with-libssl="/opt/libressl/lib" \
   ...

As I said: I get the same error (nevertheless) - but you could try that at least, or maybe you can find some other ideas from this blog post? Hope this helps.
-A

[omar-polo]

Is this problem still present in the 7.3.0p1 and/or the -master branch?

That configure check is there to avoid mixing LibreSSL headers with the OpenSSL libraries and viceversa. Unfortunately, with the way the configure script was written it was almost impossible to specify a -L flag for the linker to pick up LibreSSL if OpenSSL was installed in the default search path. Arch linux packaged OpenSMTPD with LibreSSL by passing the corresponding -L flag as part of CFLAGS to avoid these issue, but it's a total hack.

The latest release (7.3.0p1) and the -master branch should instead work correctly in this regard and respect the LDFLAGS and CFLAGS passed to the configure script; i.e.

$ ./configure LDFLAGS="-L/opt/libressl/lib" CFLAGS="-I/opt/libressl/include"

should do it.

[reuleaux]

I tried this w/ 7.3.0p1 on Debian trixie/testing. - so yes: it still is present :-(
That being said: the issue may well be on my side (some configuration bit that I missed or the like).
In that sense: I am glad that you have an eye on this.
I may get back to this and try again some time - but I have very limited time currently - I will let you know then.
Have you tried w/ 7.3.0p1 ?
Thanks again.
-A

[omar-polo]

Yeah, I've tested on FreeBSD and Arch linux. Both system have OpenSSL' libcrypto and libssl in the default search path (/usr/lib) and LibreSSL in a non-standard path (/usr/local/lib and /usr/lib/libressl` IIRC). I don't have at hand the exact configure invocations I used, will take a more careful look soon.

[unixnation]

I've also tried to build both 7.3.0p1 and 7.3.0p2 on Solaris 11(.4) with LibreSSL in /opt/libressl and am hitting the same issues.

The LDFLAGS="-L/opt/libressl/lib" CFLAGS="-I/opt/libressl/include" settings don't appear to resolve it in either case. I can pull more info out of the config.log if required.

[omar-polo]

@unixnation I did some further improvements to the configure script in the master branch (an RC1 will be released very shortly.) It now uses the 'standard' autoconf macros for searching libraries, so I would expect it to work out-of-the-box once you pass the LDFLAGS and CFLAGS to the configure. Can you please try again? If it still fails, can you share your exact ./configure invocation and its output? Thanks!

[unixnation]

Sorry for the delay in responding @omar-polo

I still seem to be having the same error message on up to date master branch (i.e. 51b1913). The full configure line was
./configure --prefix=/opt/opensmtpd --with-libssl=/opt/libressl LDFLAGS="-L/opt/libressl/lib" CFLAGS="-I/opt/libressl/include" MAKE="gmake"

The output from the configure command doesn't look hugely interesting to me but I've attached it. Let me know if you want the full 17k lines of the config.log!
configure.output.txt

[omar-polo]

@unixnation sorry for the delay. I tried to reproduce the mismatch on OpenBSD using actually the opposite situation, LibreSSL in the default search path but linking to OpenSSL in a non-default location, but it worked. FWIW I issued ./configure LDFLAGS='-L/usr/local/lib/eopenssl31/ -Wl,-rpath,/usr/local/lib/eopenssl31' CFLAGS='-I/usr/local/include/eopenssl31/'

I'll try to set up a Solaris virtual machine. Should I try to do something particular other than building and installing libressl in /opt/libressl and then attempting to build smtpd? Thanks!

[unixnation]

No worries @omar-polo :)

I checked config.log from the LibreSSL build - all I've got is ./configure --prefix=/opt/libressl and it worked. I'm sure I would have prefixed it with MAKE=gmake but that doesn't seem to be logged.

The only other thing that might be relevant is the version of autoconf packaged is v2.71?

[edrozenberg]

Same issue here attempting to build opensmtpd-7.4.0p0 w/ libressl on Linux. Installed libressl-3.7.3.

Added --with-libssl=/usr/lib64/libressl to the ./configure settings. Maybe it's not finding the header files in /usr/include/libressl but don't know how to tell it to look there.

If I remove the libressl line from ./configure it builds fine, presumably with the default openssl (1.1.1w).

[omar-polo]

@edrozenberg

Added --with-libssl=/usr/lib64/libressl to the ./configure settings. Maybe it's not finding the header files in /usr/include/libressl but don't know how to tell it to look there.

--with-libssl is a weird flag, it expects to find a subdirectory include or lib (or lib64) beneath the given path.

In most natural setups, just pass the right CFLAGS=-I/usr/incude/libressl LDFLAGS=-L/usr/lib64/libressl to the configure script.

[edrozenberg]

@omar-polo thanks! Seems like it worked after I did the following:

Added path line /usr/lib64/libressl to the file /etc/ld.so.conf and ran ldconfig

Added these flags to the existing ./configure section:

CFLAGS="-I/usr/include/libressl -I/usr/include/libressl/openssl" \
CXXFLAGS="-I/usr/include/libressl -I/usr/include/libressl/openssl" \
CPPFLAGS="-I/usr/include/libressl -I/usr/include/libressl/openssl" \
LDFLAGS="-L/usr/lib64/libressl" \

And checking deps in the smtp binary that was built:

readelf -d smtp | grep ssl
 0x0000000000000001 (NEEDED)             Shared library: [libssl.so.53]

This appears to be the libressl library.

I might still go back to letting it build with openssl since that's "automatic" rather than having to make these manual changes.

[unixnation]

--with-libssl is a weird flag, it expects to find a subdirectory include or lib (or lib64) beneath the given path.

In most natural setups, just pass the right CFLAGS=-I/usr/incude/libressl LDFLAGS=-L/usr/lib64/libressl to the configure script.

This flag seems to be the cause of the issue on my Solaris 11.4 install! Removing --with-libssl and using @omar-polo 's suggestion earlier allows configure to complete. It doesn't compile however as Solaris doesn't have endian.h it seems. I guess that's a new issue...

[omar-polo]

@unixnation ah, great to know! I'm sorry for the delay in checking the build on solaris myself but since it doesn't boot under OpenBSD vmm(4) it takes a while for me to have access to a linux machine where I can play with qemu...

Please open an issue regarding endian.h, in the meantime I'll take a look at what we can do. Thanks!

[omar-polo]

@edrozenberg sorry for the delay, forgot to reply. We recommend LibreSSL since it's what smtpd on OpenBSD uses and what (probably) get more tests with, but of course OpenSSL will work just as fine as we try to support both libraries in this -portable repository.

(said that, I'm using OpenSSL in two out of three of my smtpd instances for $reasons... ^^")

P.S.: I think the configure mix of flags can be simplified to just

./configure CFLAGS="-I/usr/include/libressl" \
	LDFLAGS="-L/usr/lib64/libressl" \
	[...]

since CXXFLAGS are unused (there's no C++ code in the repository), there's no need to add -I for the openssl path if you're compiling against LibreSSL, and while -I should technically be a CPPFLAGS you can just pass it as CFLAGS.