Can't build 1.11.7 on SuSE 11

[weberhofer]

Dear developers,
is there a chance to built sslscan for SuSE 11which comes with libopenssl1_0_0-1.0.1i ?

Thank's for this great tool!

cc -o sslscan -Wall -Wformat=2 -L/usr/local/lib -L/usr/local/ssl/lib -L/usr/local/opt/openssl/lib -L/opt/local/lib -fmessage-length=0 -grecord-gcc-switches -fstack-protector -O2 -Wall -D_FORTIFY_SOURCE=2 -funwind-tables -fasynchronous-unwind-tables -g  -DVERSION=\"1.11.7\" sslscan.c -lssl -lcrypto -ldl
In file included from sslscan.c:74:0:
sslscan.c: In function 'testFallback':
sslscan.c:876:48: error: 'SSL_MODE_SEND_FALLBACK_SCSV' undeclared (first use in this function)
                  SSL_CTX_set_mode(options->ctx, SSL_MODE_SEND_FALLBACK_SCSV);
                                                 ^
sslscan.c:876:48: note: each undeclared identifier is reported only once for each function it appears in
sslscan.c: In function 'readLine':
sslscan.c:174:10: warning: ignoring return value of 'fgets', declared with attribute warn_unused_result [-Wunused-result]
fgets(lineFromFile, maxSize, input);
          ^

[rbsec]

It's strongly recommened that you statically build against OpenSSL (make static) so that you get all of the features like SSLv2 that are often disabled in system versions of OpenSSL nowadays. However, after 3bd103d you should be able to build without SCSV Fallback support - please let me know if the build still fails.

[weberhofer]

Thank you for the quick fix! I'll see, if I can build static - packaging guidelines are not allowing this in general.

[rbsec]

If you can't build statically then sslscan probably won't have support for SSLv2 or SSLv3 ciphers, and possibly other weak ciphers as well. Using the system OpenSSL will normally result in a crippled version of sslscan that's pretty much worthless (as it can't detect all the vulnerable ciphers that you'd want to know about) - so there's limited value packaging it at all if it can't be static.