Mailing List Archive: exim: users

exim's OpenSSL "compile-time" & "runtime" versions differ. How do I make them consistent?

Index | Next | Previous | View Threaded

bendj095124367913213465 at gmail

Mar 10, 2010, 8:26 PM

Post #1 of 2 (397 views)
Permalink

exim's OpenSSL "compile-time" & "runtime" versions differ. How do I make them consistent?

I've built Exim 4.72 from git head.

exim -bV
Exim version 4.72 #1 built 10-Mar-2010 20:11:42
Copyright (c) University of Cambridge, 1995 - 2007
Berkeley DB: Berkeley DB 4.5.20: (October 24, 2009)
Support for: crypteq iconv() IPv6 PAM TCPwrappers OpenSSL
Content_Scanning DKIM Old_Demime
Lookups: lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz
dsearch mysql sqlite
Authenticators: cram_md5 dovecot plaintext
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Size of off_t: 8
-> OpenSSL compile-time version: OpenSSL 0.9.8k 25 Mar 2009
-> OpenSSL runtime version: OpenSSL 0.9.8m 25 Feb 2010
Configuration file is /usr/local/etc/exim/exim.conf

I notice that the OpenSSL compile-time & runtime versions differ.

Is that a problem?

How do I make it consistent?

@ build, my Local/Makefile contains,

...
CFLAGS=
DBMLIB=/usr/lib64/libdb-4.5.so
EXTRALIBS= -ldl -lpam
EXTRALIBS_EXIM=-lwrap
EXTRALIBS_EXIMON=
INCLUDE=-I/usr/local/ssl/openssl -I/usr/local/include -I/usr/include
LDFLAGS=-L/usr/local/ssl/lib -Wl,-rpath,/usr/local/ssl/lib -lssl
-lcrypto -L/usr/local/lib64 -L/usr/local/lib -L/usr/lib64 -L/usr/lib
-lpcre
LFLAGS=
LIBRESOLV=-lresolv
LIBS=-I/usr/lib64
LIBS_EXIM=
LIBS_EXIMON=
LOOKUP_INCLUDE=
LOOKUP_INCLUDE=-I/usr/include/mysql
LOOKUP_LIBS=-L/usr/lib64 -lmysqlclient_r
PCRE_CFLAGS=
TLS_INCLUDE=-I/usr/local/ssl/openssl
TLS_LIBS=-L/usr/local/ssl/lib -Wl,-rpath,/usr/local/ssl/lib -lssl
-lcrypto -ldl -lz
...

and, on my system,

locate openssl | grep bin
/usr/bin/openssl
/usr/local/ssl/bin/openssl
rpm -qa | grep -i openssl-0
openssl-0.9.8k-3.6.1.x86_64
/usr/bin/openssl version
OpenSSL 0.9.8k 25 Mar 2009
/usr/local/ssl/bin/openssl version
OpenSSL 0.9.8m 25 Feb 2010

which openssl
/usr/local/ssl/bin/openssl
pkg-config --libs openssl
-L/usr/local/ssl/lib -lssl -lcrypto -ldl -lz
pkg-config --cflags openssl
-I/usr/local/ssl/include

Thanks,

BenDJ

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

chris+exim at qwirx

Mar 11, 2010, 12:11 AM

Post #2 of 2 (379 views)
Permalink

Re: exim's OpenSSL "compile-time" & "runtime" versions differ. How do I make them consistent? [In reply to]

Hi Ben,

On Wed, 10 Mar 2010, Ben DJ wrote:

> -> OpenSSL compile-time version: OpenSSL 0.9.8k 25 Mar 2009
> -> OpenSSL runtime version: OpenSSL 0.9.8m 25 Feb 2010
>
> I notice that the OpenSSL compile-time & runtime versions differ.
>
> Is that a problem?

Probably not, they should be ABI compatible.

> How do I make it consistent?

Remove these parts of these variables:

> INCLUDE=-I/usr/local/ssl/openssl
> LDFLAGS=-L/usr/local/ssl/lib -Wl,-rpath,/usr/local/ssl/lib
> TLS_INCLUDE=-I/usr/local/ssl/openssl
> TLS_LIBS=-L/usr/local/ssl/lib -Wl,-rpath,/usr/local/ssl/lib

and recompile. But that's probably not the answer you want, as you
probably put those there.

I'm guessing you "upgraded" OpenSSL because of a security vulnerability,
and you want everything on your distro to use it. If so, then you may not
need to do so, as the vulnerability should have been patched by your
distro anyway, without necessarily increasing the apparent version number.

But if you insist, then installing another copy of OpenSSL is not the best
way to ensure that. Better to build a new RPM with OpenSSL 0.9.8m and use
it to replace the current 0.9.8k RPM on your system.

Cheers, Chris.
--
_ ___ __ _
/ __/ / ,__(_)_ | Chris Wilson <0000 at qwirx.com> - Cambs UK |
/ (_/ ,\/ _/ /_ \ | Security/C/C++/Java/Perl/SQL/HTML Developer |
\ _/_/_/_//_/___/ | We are GNU-free your mind-and your software |

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads