unbound: OpenSSL does not support the ECDSA curves

[testuser7]

Package Name

unbound

Maintainer

@EricLuehrsen

OpenWrt Version

SNAPSHOT

OpenWrt Target/Subtarget

mediatek/filogic

Steps to Reproduce

Unable to build unbound on latest sources. Error message:

checking whether NID_X9_62_prime256v1 is declared... no
configure: error: OpenSSL does not support the ECDSA curves: please upgrade or rerun with --disable-ecdsa

Actual Behaviour

build log

build config

Same problem was reported in this issue: #6993

Confirmation Checklist

• The package is maintained in this repository.
• I understand that issues related to the base OpenWrt repository or LuCI repository will be closed.
• I am reporting an issue for OpenWrt, not an unsupported fork.

[tiagogaspar8]

I was just going to open this issue, thanks!

[testuser7]

Does it make sense to use +@OPENSSL_WITH_EC in dependencies after this commit: openwrt/openwrt@f402626 ?

[tiagogaspar8]

You're too fast, I was actually going to post that here.
I was investigating and it seems like unbound may not be correctly detecting OpenSSL, not sure why though.
This might be an upstream issue with the version Openwrt is using though.

[hardfalcon]

I've been using Unbound 1.24.0/1.24.1 and OpenSSL 3.6.0 in my own branches of the openwrt and packages repos for a few weeks now, and I recompile my OpenWRT images several times per week. This issue has only started within the last ~ 4 days, and my best guess is that this is some side effect of openwrt/openwrt@6268692 (but I haven't tested this yet).

[tiagogaspar8]

Could it be?
If so that commit has been breaking a lot of stuff!
In the logs I see nothing relevant, but maybe I'm not checking the right place.

[testuser7]

OpenSSL detection is broken after fortify-headers update.

Before

checking size of pthread_t... 8
checking if -pthread unused during linking... no
checking for build time... 20251028
checking for SSL... found in /home/runner/work/openwrt/openwrt/mediatek_main/staging_dir/target-aarch64_cortex-a53_musl/usr
checking for EVP_sha256 in -lcrypto... yes
checking for openssl/ssl.h... yes
checking for openssl/err.h... yes
checking for openssl/rand.h... yes
checking if libssl needs libdl... no
checking if libssl needs -lcrypt32... no
checking for LibreSSL... no
checking for openssl/conf.h... yes
checking for openssl/engine.h... yes
checking for openssl/bn.h... yes
checking for openssl/dh.h... yes
checking for openssl/dsa.h... yes
checking for openssl/rsa.h... yes
checking for openssl/core_names.h... yes
checking for openssl/param_build.h... yes
checking for OPENSSL_config... yes
checking for EVP_sha1... yes
checking for EVP_sha256... yes
checking for EVP_sha512... yes
checking for FIPS_mode... no
checking for EVP_default_properties_is_fips_enabled... yes
checking for EVP_MD_CTX_new... yes
checking for OpenSSL_add_all_digests... no
checking for OPENSSL_init_crypto... yes
checking for EVP_cleanup... no
checking for ENGINE_cleanup... no
checking for ERR_load_crypto_strings... no
checking for CRYPTO_cleanup_all_ex_data... no
checking for ERR_free_strings... no
checking for RAND_cleanup... no
checking for DSA_SIG_set0... yes
checking for EVP_dss1... no
checking for EVP_DigestVerify... yes
checking for EVP_aes_256_cbc... yes
checking for EVP_EncryptInit_ex... yes
checking for HMAC_Init_ex... yes
checking for CRYPTO_THREADID_set_callback... no
checking for EVP_MAC_CTX_set_params... yes
checking for OSSL_PARAM_BLD_new... yes
checking for BIO_set_callback_ex... yes
checking for OPENSSL_init_ssl... yes
checking for SSL_CTX_set_security_level... yes
checking for SSL_set1_host... yes
checking for SSL_get0_peername... yes
checking for X509_VERIFY_PARAM_set1_host... yes
checking for SSL_CTX_set_ciphersuites... yes
checking for SSL_CTX_set_tlsext_ticket_key_evp_cb... yes
checking for SSL_CTX_set_alpn_select_cb... yes
checking for SSL_get0_alpn_selected... yes
checking for SSL_CTX_set_alpn_protos... yes
checking for SSL_get1_peer_certificate... yes
checking whether SSL_COMP_get_compression_methods is declared... yes
checking whether sk_SSL_COMP_pop_free is declared... yes
checking whether SSL_CTX_set_ecdh_auto is declared... yes
checking whether SSL_CTX_set_tmp_ecdh is declared... yes
checking the return type of HMAC_Init_ex... int
checking for EVP_PKEY_fromdata... yes
checking whether OPENSSL_NO_EC is declared... no
checking whether NID_X9_62_prime256v1 is declared... yes
checking whether NID_secp384r1 is declared... yes
checking if openssl supports SHA2 and ECDSA with EVP... yes
checking whether NID_ED25519 is declared... yes
checking whether NID_ED448 is declared... yes
checking whether MSG_FASTOPEN is declared... yes

Now

checking size of pthread_t... 0
checking if -pthread unused during linking... no
checking for build time... 20251027
checking for SSL... found in /home/runner/work/openwrt/openwrt/mediatek_main/staging_dir/target-aarch64_cortex-a53_musl/usr
checking for EVP_sha256 in -lcrypto... yes
checking for openssl/ssl.h... no
checking for openssl/err.h... no
checking for openssl/rand.h... no
checking if libssl needs libdl... no
checking if libssl needs -lcrypt32... no
checking for LibreSSL... no
checking for openssl/conf.h... no
checking for openssl/engine.h... no
checking for openssl/bn.h... no
checking for openssl/dh.h... no
checking for openssl/dsa.h... no
checking for openssl/rsa.h... no
checking for openssl/core_names.h... no
checking for openssl/param_build.h... no
checking for OPENSSL_config... yes
checking for EVP_sha1... yes
checking for EVP_sha256... yes
checking for EVP_sha512... yes
checking for FIPS_mode... no
checking for EVP_default_properties_is_fips_enabled... yes
checking for EVP_MD_CTX_new... yes
checking for OpenSSL_add_all_digests... no
checking for OPENSSL_init_crypto... yes
checking for EVP_cleanup... no
checking for ENGINE_cleanup... no
checking for ERR_load_crypto_strings... no
checking for CRYPTO_cleanup_all_ex_data... no
checking for ERR_free_strings... no
checking for RAND_cleanup... no
checking for DSA_SIG_set0... yes
checking for EVP_dss1... no
checking for EVP_DigestVerify... yes
checking for EVP_aes_256_cbc... yes
checking for EVP_EncryptInit_ex... yes
checking for HMAC_Init_ex... yes
checking for CRYPTO_THREADID_set_callback... no
checking for EVP_MAC_CTX_set_params... yes
checking for OSSL_PARAM_BLD_new... yes
checking for BIO_set_callback_ex... yes
checking for OPENSSL_init_ssl... yes
checking for SSL_CTX_set_security_level... yes
checking for SSL_set1_host... yes
checking for SSL_get0_peername... yes
checking for X509_VERIFY_PARAM_set1_host... yes
checking for SSL_CTX_set_ciphersuites... yes
checking for SSL_CTX_set_tlsext_ticket_key_evp_cb... yes
checking for SSL_CTX_set_alpn_select_cb... yes
checking for SSL_get0_alpn_selected... yes
checking for SSL_CTX_set_alpn_protos... yes
checking for SSL_get1_peer_certificate... yes
checking whether SSL_COMP_get_compression_methods is declared... no
checking whether sk_SSL_COMP_pop_free is declared... no
checking whether SSL_CTX_set_ecdh_auto is declared... no
checking whether SSL_CTX_set_tmp_ecdh is declared... no
checking the return type of HMAC_Init_ex... void
checking for EVP_PKEY_fromdata... yes
checking whether OPENSSL_NO_EC is declared... no
checking whether NID_X9_62_prime256v1 is declared... no
configure: error: OpenSSL does not support the ECDSA curves: please upgrade or rerun with --disable-ecdsa

[testuser7]

The problem is solved for now after reverting the changes on the main branch.

[hardfalcon]

@hauke : Should this issue be kept open until upstream have resolved the issues with fortify-headers 2.3.3, or should the issue be closed because your reverts have technically resolved the issue on the OpenWRT side for the time being?

[dibdot]

close resolved ticket.