PJSIP build doesn't find OpenSSL AES GCM support

Question

When I try to build PJSIP 2.6 on Lubuntu 16.04 x86_64, it doesn't find AES GCM support, even though I have OpenSSL installed.

./configure | grep -e ssl -e SSL -e crypto 
checking for OpenSSL installations..
checking openssl/ssl.h usability... yes
checking openssl/ssl.h presence... yes
checking for openssl/ssl.h... yes
checking for ERR_load_BIO_strings in -lcrypto... yes
checking for SSL_CTX_new in -lssl... yes
OpenSSL library found, SSL support enabled
OpenSSL AES GCM support not found, SRTP will only support AES CM cryptos

I also tried building a separate version of OpenSSL (1.1.0e) and the behavior is simillar. How can I enable AES GCM support?

OpenSSL 1.1.0 certainly has the AES and GCM gear. Maybe PJSIP needs to use the OpenSSL 1.0.0 line; not the OpenSSL 1.1.0 line. Many libraries still have not been updated for OpenSSL 1.1.0. You should probably file a bug report with PJSIP. You can also cite this page from OpenSSL to help porting to 1.1.0: [OpenSSL 1.1.0 Changes](https://wiki.openssl.org/index.php/OpenSSL_1.1.0_Changes) on the wiki. — jww, Apr 26 '17 at 12:57

score 1 · Accepted Answer · answered Apr 25 '17 at 16:50

What solved the problem to me was to manually compile openssl-1.0.2k. I don't know why ubuntu default (1.0.2g) would not work, but the "k" managed to work. The 1.1.0 version didn't work because the AES GCM would be tested with the following code:

#include <openssl/evp.h>
int main () {
    EVP_CIPHER_CTX ctx;
    EVP_aes_128_gcm();
    return 0;
}

Whereas both Ubuntu implementation and OpenSSL 1.1.0> expect EVP_CIPHER_CTX variables to be declared as a pointer (or perhaps initialized?). Both builds would break and the configure would understand it as no support to the cipher. Changing the test wouldn't work either because that's how it was implemented internally.

PJSIP build doesn't find OpenSSL AES GCM support

1 Answers1