Build problem

[molnarg]

I get this error message when building from git:

shrpx_ssl.cc: In function ‘SSL_CTX* shrpx::ssl::create_ssl_context(const char*, const char*)’:
shrpx_ssl.cc:162:60: error: ‘EC_KEY_new_by_curve_name’ was not declared in this scope
   auto ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
                                                            ^
shrpx_ssl.cc:169:19: error: ‘EC_KEY_free’ was not declared in this scope
   EC_KEY_free(ecdh);
                   ^

[tatsuhiro-t]

Those symbols exist only for the recent version of openSSL. 1.0.1 is safe.
Which version are you using?

[molnarg]

It's the openssl-devel package from Fedora 19, its version is 1.0.1e . Is this too old?

[tatsuhiro-t]

Not at all. I'm using the same version on debian.
For the temporal workaround, comment out the following portion of the code in src/shrpx_ssl.cc:

// Use P-256, which is sufficiently secure at the time of this
// writing.
auto ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
if(ecdh == nullptr) {
  LOG(FATAL) << "EC_KEY_new_by_curv_name failed: "
             << ERR_error_string(ERR_get_error(), nullptr);
  DIE();
}
SSL_CTX_set_tmp_ecdh(ssl_ctx, ecdh);
EC_KEY_free(ecdh);

Since ECDH support is completely optional, so this change is quite safe.

[tatsuhiro-t]

The commit 10f131c may fix the issue.

[molnarg]

Thanks, this commit fixes the problem! It seems that the fedora version is built without ECDH support?

[tatsuhiro-t]

Yeah, that is the case. OpenSSL has several configuration options for cipher suites and fedora disables ECDH for some reason.