qt4-mac fails to build with libressl 2.3.3

[bK4gYuRo]

After upgrading libressl to 2.3.3 I cannot build qt4-mac 4.8.7 on Yosemite 10.10.5

These are the errors in the log:

:info:build /usr/bin/clang++ -c -pipe -Os -stdlib=libc++ -Xarch_x86_64 -mmacosx-version-min=10.10 -fco
nstant-cfstrings -O2 -arch x86_64 -Xarch_x86_64 -mmacosx-version-min=10.10 -fvisibility=hidden -fvisib
ility-inlines-hidden -Wall -W -fPIC -DQT_SHARED -DQT_BUILD_NETWORK_LIB -DQT_NO_USING_NAMESPACE -DQT_NO
_CAST_TO_ASCII -DQT_ASCII_CAST_WARNINGS -DQT3_SUPPORT -DQT_MOC_COMPAT -DQT_USE_QSTRINGBUILDER -DQT_NO_
DEBUG -DQT_CORE_LIB -DQT_HAVE_MMX -DQT_HAVE_3DNOW -DQT_HAVE_SSE -DQT_HAVE_MMXEXT -DQT_HAVE_SSE2 -DQT_H
AVE_SSE3 -DQT_HAVE_SSSE3 -DQT_HAVE_SSE4_1 -DQT_HAVE_SSE4_2 -DQT_HAVE_AVX -D_LARGEFILE64_SOURCE -D_LARG
EFILE_SOURCE -I../../mkspecs/macx-g++ -I. -I.moc/release-shared -I../../include/QtNetwork -I.rcc/relea
se-shared -Ikernel -I../../include/QtCore -I../../include -F/opt/local/var/macports/build/_opt_local_v
ar_macports_sources_rsync.macports.org_release_tarballs_ports_aqua_qt4-mac/qt4-mac/work/qt-everywhere-
opensource-src-4.8.7/Library/Frameworks -F/opt/local/var/macports/build/_opt_local_var_macports_source
s_rsync.macports.org_release_tarballs_ports_aqua_qt4-mac/qt4-mac/work/qt-everywhere-opensource-src-4.8
.7/lib -o .obj/release-shared/qhttpnetworkconnection.o access/qhttpnetworkconnection.cpp
:info:build /usr/bin/clang++ -c -pipe -Os -stdlib=libc++ -Xarch_x86_64 -mmacosx-version-min=10.10 -fco
nstant-cfstrings -O2 -arch x86_64 -Xarch_x86_64 -mmacosx-version-min=10.10 -fvisibility=hidden -fvisib
ility-inlines-hidden -Wall -W -fPIC -DQT_SHARED -DQT_BUILD_NETWORK_LIB -DQT_NO_USING_NAMESPACE -DQT_NO
_CAST_TO_ASCII -DQT_ASCII_CAST_WARNINGS -DQT3_SUPPORT -DQT_MOC_COMPAT -DQT_USE_QSTRINGBUILDER -DQT_NO_
DEBUG -DQT_CORE_LIB -DQT_HAVE_MMX -DQT_HAVE_3DNOW -DQT_HAVE_SSE -DQT_HAVE_MMXEXT -DQT_HAVE_SSE2 -DQT_H
AVE_SSE3 -DQT_HAVE_SSSE3 -DQT_HAVE_SSE4_1 -DQT_HAVE_SSE4_2 -DQT_HAVE_AVX -D_LARGEFILE64_SOURCE -D_LARG
EFILE_SOURCE -I../../mkspecs/macx-g++ -I. -I.moc/release-shared -I../../include/QtNetwork -I.rcc/relea
se-shared -Ikernel -I../../include/QtCore -I../../include -F/opt/local/var/macports/build/_opt_local_v
ar_macports_sources_rsync.macports.org_release_tarballs_ports_aqua_qt4-mac/qt4-mac/work/qt-everywhere-
opensource-src-4.8.7/Library/Frameworks -F/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_aqua_qt4-mac/qt4-mac/work/qt-everywhere-opensource-src-4.8.7/lib -o .obj/release-shared/qhttpnetworkconnectionchannel.o access/qhttpnetworkconnectionchannel.cpp
:info:build ssl/qsslsocket_openssl_symbols.cpp:231:32: error: use of undeclared identifier 'SSLv3_client_method'; did you mean 'SSLv23_client_method'?
:info:build DEFINEFUNC(const SSL_METHOD *, SSLv3_client_method, DUMMYARG, DUMMYARG, return 0, return)
:info:build                                ^~~~~~~~~~~~~~~~~~~
:info:build                                SSLv23_client_method

[bK4gYuRo]

build log of qt4-mac

[bK4gYuRo]

Cc Me!

[mf2k (Frank Schima)]

In the future, please use WikiFormatting. As reporter, you do not need to Cc yourself.

[mkae (Marko Käning)]

Cc Me!

[bK4gYuRo]

I wonder if patch similar to ​https://issues.asterisk.org/jira/browse/ASTERISK-24799 can be used?

[bK4gYuRo]

or maybe this approach ​https://wiki.freebsd.org/LibreSSL/PatchingPorts

Resolution

Sometimes you will find an example for OPENSSL_NO_SSL2 in the code, do something similar for SSLv3. This tends to use #ifdef guards around the SSLv2 or SSLv3 code.

Example SSLv3_server_method code

ctx = SSL_CTX_new (server ? SSLv3_server_method() : SSLv3_client_method ());
Becomes

#ifndef OPENSSL_NO_SSL3
ctx = SSL_CTX_new (server ? SSLv3_server_method() : SSLv3_client_method ());
#else
ctx = SSL_CTX_new (server ? SSLv23_server_method() : SSLv23_client_method ());
SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv2);
#endif
This retains compatibility with !OpenSSL 0.9.8, 1.0.0 and 1.0.1

You can use SSLv23 methods, these have been retained in LibreSSL but negotiate TLSv1, TLSv1.1 or TLSv1.2. What it will negotiate is controlled using the SSL_CTX_set_options. You will actually improve ports that you modify!

[kylesch@…]

patch allowing qt4-mac to build against libressl by wrapping SSLv3_* function calls in macro checks using '#ifndef OPENSSL_NO_SSLV3'

[kylesch@…]

Portfile that applies patchfile patch-src_network_ssl_qsslsocket_openssl.diff as patch 27 -- the last patch applied

[kylesch@…]

I ran into this issue as well and have attached the patch I put together along with the Portfile I used to apply the patch.
See these two attachments:
​https://trac.macports.org/attachment/ticket/51135/patch-src_network_ssl_qsslsocket_openssl.diff
​https://trac.macports.org/attachment/ticket/51135/Portfile

[kylesch@…]

Cc Me!

[michaelld (Michael Dickens)]

Looks like this issue was fixed in ​https://github.com/macports/macports-ports/commit/e60744bf4b2421b8065e51631bab67f852a01e47 as patch (a). Closing