-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Closed
Description
HAVE_OPENSSL_EC doesn't get checked and set when building with a local version of OpenSSL, and the default is no EC support. As a consequence, scripts like ssl_cert.nse will display certs with elliptic curve keys as type "other" rather than as type "ec". This is becuase lua structures won't get populated in nse_ssl_cert.cc
Line 577 in e8df904
| #ifdef HAVE_OPENSSL_EC |
The root cause appears to be that the check at
Line 399 in e8df904
| AC_CHECK_LIB(crypto, EVP_PKEY_get1_EC_KEY, |
Line 366 in e8df904
| if test "$use_openssl" = "yes" -a -z "$specialssldir"; then |
This particularly applies if the desire is to build nmap with static libraries and hence not wanting to put the local libraries and includes into the system default serach paths.
A hacky workaround is to explicitly add
#define HAVE_OPENSSL_EC 1to nmap_config.h after running ./configure
Reproduction: Environment: Oracle Linux 7.9. Downloaded and built openssl 1.1.1m from openssl source tarball and "make install" to /usr/local. Downloaded nmap 7.92 source tarball,
$ ./configure --with-openssl=/usr/local --with-localdirs$ grep HAVE_OPENSSL_EC nmap_config.h/* #undef HAVE_OPENSSL_EC */'$ grep EVP_PKEY_get1_EC_KEY /usr/local/lib64/libcrypto.so000000000017be90 T EVP_PKEY_get1_EC_KEY