Topic: OpenSSL details

[tdonovan]

When you build Apache 2.2 (including mod_ssl and mod_deflate) with Visual C++, you must
* download OpenSSL from http://www.openssl.org/ into srclib\openssl
* download Zlib from http://www.zlib.net/ into srclib\zlib
and build them both first.

If you use mod_ssl for for non-commercial use which is not performance-sensitive, this is the simplest way to build OpenSSL:
EDIT: you can ignore the several "%OSVERSION%" and "Compilation failed" warnings which display when you run ms\do_ms.bat.

[glsmith]

Thanks for the info. I will have to rebuild OpenSSL 098f and 097m (for 1.3.39) with disable idea and enable Camilla.

However, I'd like to point out a few experiences I have come across.

Apache 2.0.61 & 2.2.6 building with zlib 1.2.3 will simply not compile (vc++ 6).
You can however compile mod_deflate separately with no problem, pull the zlib directory out of srclib and then build Apache and all works lovely.

Note: You have to patch 2 files in 2.0.x source to get mod_deflate built. I do not have a patch for 2.0.61, and the one written and widely available for 2.0.59 doesn't work, I assume line numbers have changed in the Apache source. One can however read the patch file and just manually do it in a few minutes.

There seems to be a bug I have run into with OpenSSL 0.9.8F and the VC-Win32.pl file it produces. It wants to go into the WinCE subroutine on WinXP which then produces an error about the OSVERSION environment variable which as far as I can tell is not set in WinXP. Edit the file and remove the entire CE subroutine (since we want Win32 anyway) and all is well.

Edit: OK, it's not a subroutine since it is all inside an elsif statement, but I digress.

I also seem not to be able to ms/do_masm on this version. I assume ms/do_nasm would run into the same problem. During the preceding nmake I get some error about some .asm file (unfortunately I do not remember right now) and this brings the compiling to a halt. ms/do_ms works fine however so I'll take the 10% hit on this go-around.

I'd post my way to get Apache 2.0.x compiled with OpenSSL 0.9.8x, but I'll save that for another thread if asked.

If you take any exception/s to this post, floggings will be graciously accepted provided I learn something from them

again, thanks for the info!

[tdonovan]

I do not see this problem building OpenSSL 0.9.8f - although there is an unrelated problem with OpenSSL 0.9.8f.

re: "There seems to be a bug I have run into with OpenSSL 0.9.8F and the VC-Win32.pl file it produces."
I don't have any VC-Win32.pl file. Do you mean the file util\pl\VC-32.pl?
This file should build the correct platform if you entered VC-WIN32 as the first argument to the PERL Configure command. Note that this argument is case-sensitive.

Also - I had no problems with ms/do_masm.bat. Can you tell us your exact error message?

-tom-

[glsmith]

sure ... Since I am now trying it with your disable idea and enable camilla, here is the specidic error I get when using do_masm

P.S. I know it is case sensitive, just like everything perl.
and yes again, util\pl\VC-32.pl ... I was going off of a couple days old memory when I posted this since I first compiled it on the 13th

using perl util\mkdef.pl crypto ssl update has no effect on the problems

H:\build\openssl-0.9.8f>perl configure VC-WIN32 --prefix=/openssl disable-idea enable-camellia
-all is good-

H:\build\openssl-0.9.8f>ms\do_masm
-all looks good-

error during nmake /f ms\ntdll.mak after using ms\do_masm

.\crypto\sha\asm\sha512-sse2.asm(29) : error A2006: undefined symbol : XMMWORD

I get 26 of them, I assume the (##) is the line numbers in the .asm file, that is the first one.

specific errors when trying to do ms\do_ms

H:\build\openssl-0.9.8f>ms\do_ms
H:\build\openssl-0.9.8f>perl util\mkfiles.pl 1>MINFO
H:\build\openssl-0.9.8f>perl util\mk1mf.pl no-asm VC-WIN32 1>ms\nt.mak
H:\build\openssl-0.9.8f>perl util\mk1mf.pl dll no-asm VC-WIN32 1>ms\ntdll.mak
H:\build\openssl-0.9.8f>perl util\mk1mf.pl no-asm VC-CE 1>ms\ce.mak
%OSVERSION% is not defined at util/pl/VC-32.pl line 41.
Compilation failed in require at util\mk1mf.pl line 138.
H:\build\openssl-0.9.8f>perl util\mk1mf.pl dll no-asm VC-CE 1>ms\cedll.mak
%OSVERSION% is not defined at util/pl/VC-32.pl line 41.
Compilation failed in require at util\mk1mf.pl line 138.

Line 41 in util/ms/VC-32.pl is inside the WinCE elsif statement. Now if I remove all the elsif to make it drop into "else" (for Win32) all works good and everything compiles during the preceding nmake.

I see I was a little off on my original post.
I've never run into this with 0.9.7x and did not run into this on 098d&e so I was a little taken back this time around.

I read your report on the unrelated bug and do not have 1 single line as you had stated in any error log. I however specifically recompiled Apache 2.2.6 against 098f and did update the 2 dll files to the 098f build in %System%. Since this particular vulnerability did have nothing to do with Apache 2.2 I may have not even tried this, however I was unsure exactly what all this would affect on the 13th and I got to the point of no return anyway so I just hammered it out.

[glsmith]

quick note:

I'm not new to compiling OpenSSL, I have done it many times successfully and some times not. I am new *hangs head* to actually tring to understand what is going on when it is doing it.

I have no clue where to really begin on the masm error but for the do_ms one I think I found at least my problem.

in ms\do_ms.bat lines 5 & 6 are the culpret
perl util\mk1mf.pl no-asm VC-CE >ms\ce.mak
perl util\mk1mf.pl dll no-asm VC-CE >ms\cedll.mak


Changing them from VC-CE to VC-WIN32 and it all worked wonderfully.
I do not believe ce.mak nor cedll.mak get used during compile so removing them may work as well.

I did start with fresh source and used
perl util\mkdef.pl crypto ssl update
right at the beginning before configure.

[tdonovan]

re: the MASM errors
Starting with 0.9.8f, OpenSSL requires a version of MASM to compile the SSE2 instructions for recent Pentium processors using the XMMWORD directive.

MASM v8 will compile this directive - but apparently MASM v6 will not. I am surprised that this has not been previously reported as an OpenSSL bug. I entered OpenSSL bug 1592 for this. I doubt they intended to use a MASM-v8-only directive.

If you want to work around this problem with OpenSSL 0.9.8f and build it with MASM v6.15+, you could edit the file crypto\sha\asm\sha512-sse2.asm prior to running NMAKE and change every occurrence of XMMWORD to QWORD.

Any recent version of NASM works OK with ms\do_Nasm.bat. Note that the NASM executable must be named nasmw.exe on Windows, and must be in your PATH.

The "%OSVERSION%" and "Compilation failed" warnings from ms\do_ms.bat are benign unless you are building for Windows-CE.
I updated the build instructions above to note this. You can continue on to NMAKE -f ms\ntdll.mak and OpenSSL will build OK.

-tom-

[glsmith]

note to self, ignore those

Thanks Tom

[tdonovan]

OpenSSL Bug 1592 which caused problems building with MASM v6 has been fixed for the next release of OpenSSL 0.9.8.

The OpenSSL developers note in the bug that NASM is preferred over MASM for building OpenSSL.
Only NASM will be supported in the next major release - OpenSSL 0.9.9.

If you don't already have NASM, you might want to consider installing it and using ms\do_Nasm.bat to build OpenSSL.

-tom-

[VoodooMill]

Terrific write up Tom!