Bug 706457 - httpd no longer resolves SSL_connect
Summary: httpd no longer resolves SSL_connect
Keywords:
Status: CLOSED CANTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: httpd
Version: 6.1
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: rc
: ---
Assignee: Joe Orton
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-05-20 16:33 UTC by Brian Wheeler
Modified: 2011-06-09 13:41 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-06-09 13:41:32 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Brian Wheeler 2011-05-20 16:33:16 UTC
Description of problem:

I have a module which was inherited from RHEL5 which worked just fine in the base RHEL6.  When I upgraded to RHEL 6.1 this morning the module wouldn't load.



Version-Release number of selected component (if applicable):

httpd-2.2.15-9.el6.x86_64

  
Actual results:

Stopping httpd:                                            [FAILED]
Starting httpd: httpd: Syntax error on line 221 of /etc/httpd/conf/httpd.conf: Syntax error on line 2 of /etc/httpd/conf.d/dlp.conf: Syntax error on line 61 of /srv/www/common/conf/httpd.conf: Cannot load /etc/httpd/modules/mod_cas.so into server: /etc/httpd/modules/mod_cas.so: undefined symbol: SSL_connect


Additional info:

rebuilding the module and linking it to libssl solved this, but it is weird that the symbol disappeared within a stable release series.

Comment 2 Joe Orton 2011-05-20 20:22:49 UTC
Nothing specific here was changed in 6.1 that I'm aware of, but in general if your module worked before it was by chance rather than by design; httpd itself does not link against libssl.  Did you change the set of loaded modules?

Comment 3 Brian Wheeler 2011-05-20 20:33:49 UTC
Nope, no changes to configuration.  I did the upgrade, and the httpd restart failed.

Comment 4 Joe Orton 2011-06-09 13:41:32 UTC
I'm sorry that this has caused inconvenience.

I think the likely cause is that OpenLDAP (which is likely linked in to your httpd indirectly) changed from using OpenSSL to Mozilla NSS in 6.1, so libssl would not get pulled in by httpd.

I don't see any appropriate remedy to this; the third-party "mod_cas" should have been linked against -lssl already and the fact that it happened to work previously was by luck rather than design.  Closing out on this basis.


Note You need to log in before you can comment on or make changes to this bug.