Cannot make with USE_SHARED_CACHE on Centos/rhel 5.6

[markabey]

I'm trying to compile stud with USE_SHARED_CACHE on centos 5.6
I added an option to the Makefile CFLAGS to show the compiler where to find libev (-I/usr/include/libev)
A normal make without USE_SHARED_CACHE=1 seems to work correctly

When I run make here is what I get:

[root@au-build-vm1 stud]# make clean
rm -f stud stud.o ringbuffer.o
[root@au-build-vm1 stud]# make USE_SHARED_CACHE=1
cc -O2 -g -std=c99 -fno-strict-aliasing -Wall -W -D_GNU_SOURCE -I/usr/include/libev -DUSE_SHARED_CACHE -DUSE_SYSCALL_FUTEX -c -o stud.o stud.c
stud.c: In function ‘handle_shcupd’:
stud.c:336: warning: implicit declaration of function ‘HMAC’
stud.c: In function ‘init_openssl’:
stud.c:675: error: ‘SSL_OP_NO_TICKET’ undeclared (first use in this function)
stud.c:675: error: (Each undeclared identifier is reported only once
stud.c:675: error: for each function it appears in.)
make: ** [stud.o] Error 1*

I am on
[root@au-build-vm1 stud]# openssl version
OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
[root@au-build-vm1 stud]# uname -a
Linux au-build-vm1 2.6.18-238.el5xen #1 SMP Thu Jan 13 16:41:45 EST 2011 x86_64 x86_64 x86_64 GNU/Linux
[root@au-build-vm1 stud]# cc -v
_Using built-in specs.
Target: x86_64-redhat-linux
Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-_cxa_atexit --disable-libunwind-exceptions --enable-libgcj-multifile --enable-languages=c,c++,objc,obj-c++,java,fortran,ada --enable-java-awt=gtk --disable-dssi --disable-plugin --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre --with-cpu=generic --host=x86_64-redhat-linux
Thread model: posix
gcc version 4.1.2 20080704 (Red Hat 4.1.2-51)

[markabey]

However, commenting out line 675 in stud.c allows compilation without errors.
/*SSL_CTX_set_options(ctx, SSL_OP_NO_TICKET); */
It seems to work without errors in my testing. Any idea what that line does?

[jamwt]

On the basis of your error and things like this:

http://www.exim.org/lurker/message/20110322.131702.add4ddf4.pt-BR.html

Yeah, I'm guessing the version of OpenSSL on that RHEL is too old to use that particular option.

That option seems to disable RFC4507bis session resumption when a client re-connections--a mode that would allow the session to resume cheaply without renegotiation. My guess is the multi-host UDP-broadcast shared cache setup is incompatible with RFC4507bis session resumption b/c you're likely connecting to a different node, and that node does not have the necessary state in memory to resume session using that method.

I'm not sure what the consequences of disabling it are, but my guess would be it will attempt the resumption, the resumption will fail, and then it will fall back to other methods. So disabling it is likely just an optimization.