Unable to build nginx quic

[Karthikdasari0423@…]

I am trying to build nginx quic with nginx version as release-1.25.0 but facing below error

src/os/unix/ngx_thread_mutex.c

cc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g -I/src/boringssl/include -I src/core -I src/event -I src/event/modules -I src/event/quic -I src/os/unix -I objs \

-o objs/src/os/unix/ngx_thread_id.o \
src/os/unix/ngx_thread_id.c

cc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g -I/src/boringssl/include -I src/core -I src/event -I src/event/modules -I src/event/quic -I src/os/unix -I objs \

-o objs/src/event/ngx_event_openssl.o \
src/event/ngx_event_openssl.c

src/event/ngx_event_openssl.c: In function ‘ngx_ssl_get_curve’:
src/event/ngx_event_openssl.c:5110:20: error: ‘TLSEXT_nid_unknown’ undeclared (first use in this function)

5110 | if ((nid & TLSEXT_nid_unknown) == 0) {

| ^~

src/event/ngx_event_openssl.c:5110:20: note: each undeclared identifier is reported only once for each function it appears in
make[1]: * [objs/Makefile:999: objs/src/event/ngx_event_openssl.o] Error 1
make[1]: Leaving directory '/src/nginx-quic'
make: * [Makefile:10: build] Error 2
root@ubuntu:/src/nginx-quic#

Could you please confirm is this known issue or am i missing anything?

Commands i ran

cd /src/nginx-quic/
auto/configure nginx -V 2>&1 | sed "s/ \-\-/ \\\ \n\t--/g" | grep -v -e 'http-geoip2' | grep "\-\-" | grep -ve opt= -e param= -e build= --build=nginx-quic --with-debug --with-http_v3_module --with-cc-opt="-I/src/boringssl/include" --with-ld-opt="-L/src/boringssl/build/ssl -L/src/boringssl/build/crypto"
make

[Karthikdasari0423@…]

i believe this is the commit causing the issue

​https://boringssl.googlesource.com/boringssl/+/6cf98208371e5c2c8b9d34ce3b8c452ea90e2963

[Karthikdasari0423@…]

Just a small update
i tried with the old commit(​https://github.com/google/boringssl/commit/2da5ba91205f9f3cbb423064e11c165580307f82) and nginx is fine

with latest boringssl facing the issue

[Sergey Kandaurov]

Replying to Karthikdasari0423@…:

i believe this is the commit causing the issue

​https://boringssl.googlesource.com/boringssl/+/6cf98208371e5c2c8b9d34ce3b8c452ea90e2963

That's true. This commit caused build to fail with BoringSSL.
The reason is that SSL_get_negotiation_group, as documented in OpenSSL, may return TLSEXT_nid_unknown for unknown groups. This seems to be a non-sense, but still we have to comply.
BoringSSL added this function in the recent days, and corresponding nginx code now builds a corresponding piece of code. BoringSSL is going smarter, it doesn't use TLSEXT_nid_unknown, so it was not added there. Well, it was there long ago, removed together with SSL_get1_curves().

Can you please retry with the most recent BoringSSL ? It should be fixed now in ​https://boringssl.googlesource.com/boringssl/+/28c24092e39bfd70852afa2923a3d12d2e9be2f5

[Karthikdasari0423@…]

Replying to Sergey Kandaurov:

Replying to Karthikdasari0423@…:

i believe this is the commit causing the issue

​https://boringssl.googlesource.com/boringssl/+/6cf98208371e5c2c8b9d34ce3b8c452ea90e2963

That's true. This commit caused build to fail with BoringSSL.
The reason is that SSL_get_negotiation_group, as documented in OpenSSL, may return TLSEXT_nid_unknown for unknown groups. This seems to be a non-sense, but still we have to comply.
BoringSSL added this function in the recent days, and corresponding nginx code now builds with it. BoringSSL is going smarter, it doesn't use TLSEXT_nid_unknown, so it was not added there. Well, it was there long ago, removed together with SSL_get1_curves().

Can you please retry with the most recent BoringSSL ? It should be fixed now in ​https://boringssl.googlesource.com/boringssl/+/28c24092e39bfd70852afa2923a3d12d2e9be2f5

i tried with latest boringssl and able to build nginx quic.

Thank you Sergey Kandaurov.

[Karthikdasari0423@…]

Please feel free to close this ticket.

[Maxim Dounin]

Thanks for the update, closing this.

[Karthikdasari0423@…]

Thank you Maxim Dounin for closing this bug.
Can you please explain why you have marked this bug as Invalid.
This bug is valid bug and i would recommend you to mark it as Closed or Resolved but not as invalid.

[Karthikdasari0423@…]

Re-opening this bug cause i would recommend to mark it as Closed or Resolved but not as Invalid.

[Maxim Dounin]

It's not a bug in nginx, but a bug in BoringSSL (which is now fixed). As such, this ticket is closed as invalid.

[Karthikdasari0423@…]

okay,got it.
Thank you Maxim Dounin.

[m.herasimovich]

Milestone renamed