Compiling STARTTLS in sendmail

Last Update 2001-09-05

[Compilation] [Disclaimer] [Patents] [Problems]

Introduction

Compilation

Unless you have bought Sendmail Secure Switch you need to compile sendmail yourself to get STARTTLS support. You need (beside the MTA itself) Please read the docs accompanying the OpenSSL library and sfio. You have to compile and install both libraries before you can compile sendmail. The sfio include file stdio.h must be installed in a subdirectory called sfio, i.e., if you install sfio in /usr/local, stdio.h should be in /usr/local/include/sfio, and libsfio.a should be in /usr/local/lib. See devtools/README how to set the correct compile time parameters; you should at least set the following values:
define(`confSTDIO_TYPE', `portable')
APPENDDEF(`confENVDEF', `-DSFIO')
APPENDDEF(`confLIBS', `-lsfio')
APPENDDEF(`conf_sendmail_ENVDEF', `-DSTARTTLS')
APPENDDEF(`conf_sendmail_LIBS', `-lssl -lcrypto')

Notes

sfio is viral, i.e., it must be used in all libraries with which sendmail exchanges file pointers (FILE *). That is, libsmutil must be compiled with sfio, which is accomplished by the above config file. Another example is PH map support.
This does not apply to the usual libraries, e.g., OpenSSL, Berkeley DB, Cyrus-SASL, et.al.

There is a trick for those who are brave...

As explained in sendmail/README and the Sendmail Installation and Operation Guide, you must have a good source for (pseudo) random numbers.

Warning/Disclaimer

Disclaimer

This warning taken from OpenSSL applies to sendmail 8.11 as well:

PLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY SOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING TECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME PARTS OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR COUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL TECHNICAL SUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT AND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHORS OF OPENSSL ARE NOT LIABLE FOR ANY VIOLATIONS YOU MAKE HERE. SO BE CAREFUL, IT IS YOUR RESPONSIBILITY.

PATENTS

The following text is taken from the README file of the OpenSSL distribution:

Various companies hold various patents for various algorithms in various locations around the world. YOU are responsible for ensuring that your use of any algorithms is legal by checking if there are any patents in your country. The file contains some of the patents that we know about or are rumoured to exist. This is not a definitive list.

RSA Data Security holds software patents on the RSA and RC5 algorithms. If their ciphers are used used inside the USA (and Japan?), you must contact RSA Data Security for licensing conditions. Their web page is http://www.rsa.com/.

RC4 is a trademark of RSA Data Security, so use of this label should perhaps only be used with RSA Data Security's permission.

The IDEA algorithm is patented by Ascom in Austria, France, Germany, Italy, Japan, Netherlands, Spain, Sweden, Switzerland, UK and the USA. They should be contacted if that algorithm is to be used, their web page is http://www.ascom.ch/.

If you're not certain about patents, etc, you may consider to buy Sendmail Secure Switch instead.

Problems

Some OS have problems with sfio or OpenSSL.

For example, some Linux versions have a problem with the interaction between syslog.h and sfio Qouting Neil W Rickert: On the first attempt, the compilation failed, with an error at line 189 of sys/syslog.h. This seems to be due to some strange bogosity of gcc, and the syslog.h header file using that. The preprocessor output contained

void    syslog  (int, __const char * , ... )  
	__attribute__ ((format (_stdprintf , 2, 0)))
I'm not sure what gcc is doing with that __attribute__ business. However, the replacement of 'printf' by '_stdprintf', due to the SFIO includes, sure confused it. This affects anything compiled with SFIO on this system, which also uses syslog.h (such as the PH map library). My solution was to edit the SFIO version of 'stdio.h', and add
#include <syslog.h>
as the very first line. This ensures that syslog.h is included first.

Some (most?) AIX versions can't compile sendmail with OpenSSL since there is a name conflict about the macro Free.


[(links)] [Hints] [Avoiding UBE] [cf/README] [New]
Copyright © Claus Aßmann Please send comments to: <ca at sendmail.org>
Disclaimer: the information provided may be inaccurate or outdated or incomplete. Please contact me if you find an error.