cmake: Multiple SSL backends causes build failure in combination with optional protocols

[diizzyy]

I did this

I'm not entirely sure how this is supposed to work but looking at both CMake and Autotools utilizing multiple SSL backends are supported. However if you enable HTTP3 support for example at least with CMake this possibly unintentionally breaks the build.

Lets say you have OpenSSL 3.0 which doesn't support QUIC but you also have fairly recent version of GnuTLS such as 3.8.10

Now if you enable HTTP3 support using (lib)ngtcp2, and both OpenSSL and GnuTLS it'll set OpenSSL support as required which fails as it's older than 3.5. The only way to get around this is to disable OpenSSL alltogether, not sure if that's the intention?

I expected the following

No response

curl/libcurl version

curl 8.15.0 (release)

operating system

FreeBSD 14.3-RELEASE

[bagder]

multissl does not work with HTTP/3. Pick which one you like.

[vszakats]

Unless the build failure is "MultiSSL cannot be enabled with HTTP/3 and vice versa.",
can you post your cmake command-line and output, with the error message?

[diizzyy]

Sure,

-DCMAKE_DEBUG_POSTFIX=""  -DCURL_CA_BUNDLE=none  -DCURL_CA_PATH=none -DCURL_DISABLE_ALTSVC:BOOL=false -DCURL_BROTLI:BOOL=true -DENABLE_ARES:BOOL=false -DCURL_DISABLE_COOKIES:BOOL=false -DENABLE_CURLDEBUG:BOOL=false -DENABLE_DEBUG:BOOL=true -DCURL_DISABLE_DICT:BOOL=false -DCURL_COMPLETION_FISH:BOOL=false -DCURL_DISABLE_FTP:BOOL=false -DCURL_CA_FALLBACK:BOOL=true -DCURL_USE_GNUTLS:BOOL=true -DCURL_DISABLE_GOPHER:BOOL=false -DCURL_DISABLE_HTTP:BOOL=false -DUSE_NGHTTP2:BOOL=true -DUSE_NGTCP2:BOOL=true -DUSE_LIBIDN2:BOOL=true -DCURL_DISABLE_IMAP:BOOL=false -DCURL_DISABLE_IPFS:BOOL=false -DENABLE_IPV6:BOOL=true -DCURL_DISABLE_LDAP:BOOL=true -DCURL_DISABLE_LDAPS:BOOL=true -DCURL_USE_LIBSSH:BOOL=false -DCURL_USE_LIBSSH2:BOOL=true -DCURL_USE_LIBUV:BOOL=true -DBUILD_LIBCURL_DOCS:BOOL=true -DBUILD_MISC_DOCS:BOOL=true -DENABLE_CURL_MANUAL:BOOL=true -DCURL_DISABLE_MQTT:BOOL=true -DCURL_DISABLE_NTLM:BOOL=false -DCURL_CA_FALLBACK:BOOL=true -DCURL_USE_OPENSSL:BOOL=true -DCURL_DISABLE_POP3:BOOL=false -DCURL_DISABLE_PROXY:BOOL=false -DCURL_USE_LIBPSL:BOOL=true -DCURL_DISABLE_RTSP:BOOL=false -DCURL_DISABLE_SMB:BOOL=true -DCURL_DISABLE_SMTP:BOOL=false -DBUILD_STATIC_LIBS:BOOL=false -DCURL_DISABLE_TELNET:BOOL=false -DCURL_DISABLE_TFTP:BOOL=false -DENABLE_THREADED_RESOLVER:BOOL=true -DCURL_DISABLE_SRP:BOOL=false -DCURL_DISABLE_WEBSOCKETS:BOOL=false -DCURL_USE_WOLFSSL:BOOL=false -DCURL_COMPLETION_ZSH:BOOL=true -DCURL_ZSTD:BOOL=true -DCMAKE_C_COMPILER:STRING="cc"  -DCMAKE_CXX_COMPILER:STRING="c++"  -DCMAKE_C_FLAGS:STRING="-O2 -pipe -march=znver3  -fstack-protector-strong -fno-strict-aliasing "  -DCMAKE_C_FLAGS_DEBUG:STRING="-O2 -pipe -march=znver3  -fstack-protector-strong -fno-strict-aliasing "  -DCMAKE_C_FLAGS_RELEASE:STRING="-O2 -pipe -march=znver3  -fstack-protector-strong -fno-strict-aliasing  -DNDEBUG"  -DCMAKE_CXX_FLAGS:STRING="-O2 -pipe -march=znver3 -fstack-protector-strong -fno-strict-aliasing  "  -DCMAKE_CXX_FLAGS_DEBUG:STRING="-O2 -pipe -march=znver3 -fstack-protector-strong -fno-strict-aliasing  "  -DCMAKE_CXX_FLAGS_RELEASE:STRING="-O2 -pipe -march=znver3 -fstack-protector-strong -fno-strict-aliasing   -DNDEBUG"  -DCMAKE_EXE_LINKER_FLAGS:STRING="  "  -DCMAKE_MODULE_LINKER_FLAGS:STRING="  "  -DCMAKE_SHARED_LINKER_FLAGS:STRING="  "  -DCMAKE_INSTALL_PREFIX:PATH="/usr/local"  -DCMAKE_AUTOGEN_PARALLEL:STRING="8"  -DCMAKE_BUILD_TYPE:STRING="Release"  -DTHREADS_HAVE_PTHREAD_ARG:BOOL=YES  -DCMAKE_INSTALL_RPATH_USE_LINK_PATH=YES  -DCMAKE_VERBOSE_MAKEFILE:BOOL=ON  -DFETCHCONTENT_FULLY_DISCONNECTED:BOOL=ON -DCMAKE_BUILD_RPATH_USE_ORIGIN:BOOL=ON -DUSE_SSLS_EXPORT:BOOL=ON -DBUILD_TESTING:BOOL=OFF -GNinja -DPython_ADDITIONAL_VERSIONS=3.11 -DPython_EXECUTABLE:FILEPATH="/usr/local/bin/python3.11" -DPython3_EXECUTABLE:FILEPATH="/usr/local/bin/python3.11" -DBOOST_PYTHON_SUFFIX:STRING=311

-- Checking for module 'libnghttp2'
--   Found libnghttp2, version 1.66.0
-- Found NGHTTP2 (via pkg-config): /usr/local/include (found version "1.66.0")
-- Checking for modules 'libngtcp2;libngtcp2_crypto_quictls'
--   Package 'libngtcp2_crypto_quictls' not found
CMake Error at /usr/local/share/cmake/Modules/FindPackageHandleStandardArgs.cmake:233 (message):
  Could NOT find NGTCP2 (missing: quictls) (found version "1.14.0")
Call Stack (most recent call first):
  /usr/local/share/cmake/Modules/FindPackageHandleStandardArgs.cmake:603 (_FPHSA_FAILURE_MESSAGE)
  CMake/FindNGTCP2.cmake:113 (find_package_handle_standard_args)
  CMakeLists.txt:1101 (find_package)

[vszakats]

This looks like a dump of the cache. I couldn't reproduce based on this.

Do you have your actual cmake invocation, and the complete configure
log that lead into the error? Thanks.

[vszakats]

Got it, maybe. Reproducer when combined with OpenSSL <3.5.0:

-DCURL_USE_GNUTLS=ON -DUSE_NGTCP2=ON -DCURL_USE_OPENSSL=ON

[vszakats]

Assuming my reproducer matches the one of the OP. GnuTLS and
OpenSSL are both explicitly requested with H3, but the detected
OpenSSL version doesn't support H3. Then cmake looks for quicktls
as the next best option, and fails with an error finding an ngtcp2
crypto module for it, instead of the expected error message.

@diizzyy Does this improve the error message for you?:

--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1093,7 +1093,9 @@ endif()
 
 option(USE_NGTCP2 "Use ngtcp2 and nghttp3 libraries for HTTP/3 support" OFF)
 if(USE_NGTCP2)
-  if(USE_OPENSSL OR USE_WOLFSSL)
+  if(CURL_WITH_MULTI_SSL)
+    message(FATAL_ERROR "MultiSSL cannot be enabled with HTTP/3 and vice versa.")
+  elseif(USE_OPENSSL OR USE_WOLFSSL)
     if(USE_WOLFSSL)
       find_package(NGTCP2 REQUIRED "wolfSSL")
     elseif(HAVE_BORINGSSL OR HAVE_AWSLC)

if my reproducer isn't the reported one, I'll need the original cmake
command-line and the complete configure log leading up to the error.

[diizzyy]

@vszakats
Yes, that makes it clearer :-)