ircd-hybrid does not connect with other servers due to libssl1.0.0 incompatibility

[Dave]

ircd-hybrid does not come with SSL enabled by default, although there are simple instructions provided in usr/share/doc/ircd-hybrid/CRYPTLINKS.txt. However, following these instructions on a 12.04LTS system builds an ircd that still does not have working cryptolinks functionality, due to, I believe, an incompatibility with libssl1.0.0.

In detail:
1) On a freshly installed 12.04LTS (64bit) "server install" system I did:
apt-get source ircd-hybrid
..which got me the source of package 7.2.2.dfsg.2-6.3

2) Following the instructions in CRYPTLINKS.txt I did:
$ USE_OPENSSL=1 fakeroot debian/rules binary

...which, during the configure phase, resulted in
checking for OpenSSL 0.9.6 or above... found
checking for RSA_free in -lcrypto... yes
checking for EVP_bf_cfb... no
checking for EVP_cast5_cfb... no
checking for EVP_idea_cfb... no
checking for EVP_rc5_32_12_16_cfb... no
checking for EVP_des_ede3_cfb... no
checking for EVP_des_cfb... no
...
Installing into: /usr
Ziplinks ................ yes
OpenSSL ................. no

Here, the SSL cyphers are all not found. I strongly believe that the cause is that libssl1.0.0 calls these cyphers names like EVP_bf_cfb64, EVP_des_ede3_cfb64, and so on, rather than the names given above, which do not have the '64' suffix. Although the build continued and completed, the result of this build was an ircd that was unable to connect to other ircds that were running cryptlinks. Error messages and sniffing the tcp links, looking at the "CAPAB" capability messages suggested a lack of cyphers, which is consistent with the messages above.

To "fix" the problem myself, I continued...
3) I needed to install libssl0.9.8, but although that is available in 12.04LTS, libssl-dev is only available as 1.0.0. I therefore had to obtain and install libssl0.9.8_0.9.8k-7ubuntu8_amd64.deb and libssl-dev_0.9.8k-7ubuntu8_amd64.deb from the Ubuntu 10.04LTS/Lucid release, and remove the provided libssl-dev package.

4) With this new set-up, issuing
$ USE_OPENSSL=1 fakeroot debian/rules binary
...resulted in build errors. I believe these build errors are related to the removal of lib/pcre from the source package. The file debian/patches/16_use_debian_pcre.dpatch addressed this, but I believe that it was possibly never tested against a build with SSL enabled. After some work, I produced my own version of this patch 16 (attached).

With a fresh "apt-get source" tree, and this modified patch 16 replacing the one in debian/patches, the configure stage now reports the expected output, that OpenSSL has found cyphers:
OpenSSL ................. yes - BF/168 BF/128 CAST/128 3DES/168 DES/56

..and the resulting built package then installs an ircd-hybrid that correctly connects to other ircds running cryptlinks.

I'm afraid I don't understand enough to fix this bug correctly - i.e. to make it correctly compatible with libssl1.0.0, but I hope I've provided enough information here to help someone more knowledgeable than me attack the problem.

My system is a fresh install of the server edition of Ubuntu 12.04LTS 64bit.

--Dave

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Replacement 16_use_debian_pcre.dpatch to allow ircd-hybrid to be built on a 12.04LTS system, using libssl-dev0.9.8 pulled in from 10.04LTS" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]