Skip to content

aes_ctr not supported with >=openssl-3.0 #1980

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

aes_ctr not supported with >=openssl-3.0 #1980

wants to merge 1 commit into from

Conversation

@PPN-SD
Copy link
Contributor

@PPN-SD PPN-SD commented Sep 13, 2025

crypto.c:742:7: error: call to undeclared function 'ctr_incr'; ISO C99
and later do not support implicit function
declarations [-Wimplicit-function-declaration]
742 | ctr_incr(ace->counter, AES_BLOCK_SIZE);
| ^

@PPN-SD
aes_crt is not support with >=openssl-3.0
6d01519 
>crypto.c:742:7: error: call to undeclared function 'ctr_incr'; ISO C99
>and later do not support implicit function
>      declarations [-Wimplicit-function-declaration]
>        742 |       ctr_incr(ace->counter, AES_BLOCK_SIZE);
>	      |       ^
@PPN-SD PPN-SD changed the title aes_crt is not support with >=openssl-3.0 aes_crt not supported with >=openssl-3.0 Sep 13, 2025
@Castaglia
Copy link
Member

Castaglia commented Sep 13, 2025

Please provide some specifics about your build environment used to encounter this issue, including:

  • Compiler (and compiler version)
  • ProFTPD ./configure flags used
  • Platform (Ubuntu, BSD, etc)
  • OpenSSL version

These details will help me reproduce the reported behavior locally. Thanks!

@PPN-SD
Copy link
Contributor Author

PPN-SD commented Sep 13, 2025 •
edited by Castaglia
Loading

Compiler : clang-21

./configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --datarootdir=/usr/share --disable-static --docdir=/usr/share/doc/proftpd-1.3.9-r3 --htmldir=/usr/share/doc/proftpd-1.3.9-r3/html --libdir=/usr/lib64 --cache-file=/var/tmp/portage/net-ftp/proftpd-1.3.9-r3/work/proftpd-1.3.9/config.cache --localstatedir=/run/proftpd --sysconfdir=/etc/proftpd --disable-strip --disable-facl --disable-auth-file --disable-cap --disable-ctrls --disable-dso --disable-ident --disable-memcache --disable-ncurses --disable-nls --enable-openssl --disable-auth-pam --disable-pcre --disable-sodium --disable-tests --enable-trace --enable-shadow --enable-autoshadow --with-modules=mod_sftp:mod_tls:mod_tls_shmcache

Linux/Gentoo

OpenSSL : it fails w/ 3.5.2. it compiles with 1.1.1w

@Castaglia
Copy link
Member

Castaglia commented Sep 14, 2025

Interesting. I don't usually use Gentoo; for this, I'm attempting to reproduce this using an Alpine Docker image, with this Dockerfile:

FROM alpine:3.22

RUN apk update && \
  apk add \
    bash \
    build-base \
    compiler-rt \
    gcc \
    make \
    openssl \
    openssl-dev \
    vim

CMD ["bash"]

This installs OpenSSL 3.5.2, per:

# openssl version -a
OpenSSL 3.5.2 5 Aug 2025 (Library: OpenSSL 3.5.2 5 Aug 2025)
built on: Tue Aug 19 12:37:49 2025 UTC
platform: linux-aarch64
options:  bn(64,64)
compiler: cc -fPIC -pthread -Wa,--noexecstack -Os -fstack-clash-protection -Wformat -Werror=format-security -g -Os -fstack-clash-protection -Wformat -Werror=format-security -g -Wa,--noexecstack -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
OPENSSLDIR: "/etc/ssl"
ENGINESDIR: "/usr/lib/engines-3"
MODULESDIR: "/usr/lib/ossl-modules"
Seeding source: os-specific
CPUINFO: OPENSSL_armcap=0x8fd

Using this container, with the latest ProFTPD source code, built using:

./configure --with-modules=mod_sftp:mod_tls --enable-devel
make
...
gcc  -DHAVE_CONFIG_H  -DLINUX  -I. -I../.. -I../../include -I./../../include  -g2  -Wall -fno-omit-frame-pointer -fno-strict-aliasing -Wdangling-else -Wextra -Werror=implicit-function-declaration -Winit-self -Wno-missing-field-initializers -Wno-unused-parameter -Wnull-dereference -fdelete-null-pointer-checks -g3 -O0 -Wcast-align -Wchar-subscripts -Winline -Wstrict-prototypes -Wmissing-declarations -Wnested-externs -Wpointer-arith -Wshadow -Wundef -Wcomment -Wdangling-else -Wdeclaration-after-statement -Wduplicated-branches -Wfloat-equal -Wformat -Wformat-security -Wimplicit-function-declaration -Wmaybe-uninitialized -Wmissing-braces -Wparentheses -Wpointer-to-int-cast -Wreturn-local-addr -Wstack-protector -Wstrict-overflow -Wswitch -Wunreachable-code -Wunused-variable -fstack-protector -fstack-protector-all -fno-common -c keys.c
gcc  -DHAVE_CONFIG_H  -DLINUX  -I. -I../.. -I../../include -I./../../include  -g2  -Wall -fno-omit-frame-pointer -fno-strict-aliasing -Wdangling-else -Wextra -Werror=implicit-function-declaration -Winit-self -Wno-missing-field-initializers -Wno-unused-parameter -Wnull-dereference -fdelete-null-pointer-checks -g3 -O0 -Wcast-align -Wchar-subscripts -Winline -Wstrict-prototypes -Wmissing-declarations -Wnested-externs -Wpointer-arith -Wshadow -Wundef -Wcomment -Wdangling-else -Wdeclaration-after-statement -Wduplicated-branches -Wfloat-equal -Wformat -Wformat-security -Wimplicit-function-declaration -Wmaybe-uninitialized -Wmissing-braces -Wparentheses -Wpointer-to-int-cast -Wreturn-local-addr -Wstack-protector -Wstrict-overflow -Wswitch -Wunreachable-code -Wunused-variable -fstack-protector -fstack-protector-all -fno-common -c crypto.c
gcc  -DHAVE_CONFIG_H  -DLINUX  -I. -I../.. -I../../include -I./../../include  -g2  -Wall -fno-omit-frame-pointer -fno-strict-aliasing -Wdangling-else -Wextra -Werror=implicit-function-declaration -Winit-self -Wno-missing-field-initializers -Wno-unused-parameter -Wnull-dereference -fdelete-null-pointer-checks -g3 -O0 -Wcast-align -Wchar-subscripts -Winline -Wstrict-prototypes -Wmissing-declarations -Wnested-externs -Wpointer-arith -Wshadow -Wundef -Wcomment -Wdangling-else -Wdeclaration-after-statement -Wduplicated-branches -Wfloat-equal -Wformat -Wformat-security -Wimplicit-function-declaration -Wmaybe-uninitialized -Wmissing-braces -Wparentheses -Wpointer-to-int-cast -Wreturn-local-addr -Wstack-protector -Wstrict-overflow -Wswitch -Wunreachable-code -Wunused-variable -fstack-protector -fstack-protector-all -fno-common -c utf8.c
...

I am not seeing the reported behavior. I also tried using Clang instead of GCC; still no build issues or warnings encountered. Hmm. I wonder what might be different?

@PPN-SD
Copy link
Contributor Author

PPN-SD commented Sep 14, 2025 •
edited
Loading

Maybe try building proftpd with -DOPENSSL_NO_DEPRECATED_3_0 ? (openssl/openssl@0016a03)

@Castaglia
Copy link
Member

Castaglia commented Oct 22, 2025

Maybe try building proftpd with -DOPENSSL_NO_DEPRECATED_3_0 ? (openssl/openssl@0016a03)

Hmm. I tried this as well, using an Ubuntu 25:10 image (which installs OpenSSL 3.5.3), along with clang:

./configure CC=clang CFLAGS=-DOPENSSL_NO_DEPRECATED_3_0 --with-modules=mod_sftp:mod_tls:mod_tls_shmcache

Still no compilation failures or warnings for that mod_sftp crypto.c file:

clang  -DHAVE_CONFIG_H  -DLINUX  -I. -I../.. -I../../include -I./../../include  -g2 -DOPENSSL_NO_DEPRECATED_3_0 -Wall -fno-omit-frame-pointer -fno-strict-aliasing -c crypto.c

Compilation of ProFTPD, with the selected modules still succeeds for me.

@PPN-SD
Copy link
Contributor Author

PPN-SD commented Oct 22, 2025

OK. I'll try on my side, maybe a strict compiler flag.
Anyway, that's deprecated in 3.0 (https://docs.openssl.org/master/man7/ossl-guide-migration/#deprecated-low-level-encryption-functions).

@PPN-SD PPN-SD changed the title aes_crt not supported with >=openssl-3.0 aes_ctr not supported with >=openssl-3.0 Oct 22, 2025
@Castaglia
Copy link
Member

Castaglia commented Oct 22, 2025

OK. I'll try on my side, maybe a strict compiler flag. Anyway, that's deprecated in 3.0 (https://docs.openssl.org/master/man7/ossl-guide-migration/#deprecated-low-level-encryption-functions).

Understood. I'd like to reproduce that exact build failure locally, so that I can see what other consequences there might be.

On your Gentoo box, what does openssl version -a show? I'm wondering if your local OpenSSL 3.x installation was built with other compiler flags/options that also might be involved here. Thanks!

@PPN-SD
Copy link
Contributor Author

PPN-SD commented Oct 23, 2025

With the same version of openssl, it occurs only with clang-21, gcc-15 is fine. clang is somewhere stricter I guess : ctr_incr is declared only w/ <openssl-3

OpenSSL 3.5.4 30 Sep 2025 (Library: OpenSSL 3.5.4 30 Sep 2025)
built on: Fri Oct  3 01:38:16 2025 UTC
platform: linux-x86_64
options:  bn(64,64)
compiler: x86_64-pc-linux-gnu-gcc -fPIC -pthread -m64 -Wa,--noexecstack -O2 -pipe -march=x86-64-v3 -mtune=generic -frecord-gcc-switches -fno-strict-aliasing -Wa,--noexecstack -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
OPENSSLDIR: "/etc/ssl"
ENGINESDIR: "/usr/lib64/engines-3"
MODULESDIR: "/usr/lib64/ossl-modules"
Seeding source: os-specific
CPUINFO: OPENSSL_ia32cap=0x7ef8320b078bffff:0x00400004219c91a9:0x0000000000000000:0x0000000000000000:0x0000000000000000

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@PPN-SD @Castaglia