Ubuntu 20.04上编译OpenSSL的编译选项设置
由于实验需要，我想简单看看怎么在编译OpenSSL的时候设置编译选项，之前都是用的默认选项，例如这里：怎样在BinaryNinja中查看Vulnerable的function（以HeartBleed CVE-2014-0160为例）_蛐蛐蛐的博客-CSDN博客
首先下载一个对应版本，例如我在这里：/source/old/3.0/index.html下载了openssl-3.0.0.tar.gz。解压之后进入文件夹。搜了一圈发现，虽然介绍的博客很多，但是基本上大家都没有详细介绍编译选项，例如这里的介绍：linux编译openss,Linux下OpenSSL静态库编译及使用_币圈E神的博客-CSDN博客
大部分文章都只是介绍了默认的编译选项和过程。例如：linux平台下openssl编译_slacking off的博客-CSDN博客_linux openssl 编译
然而简单看了一下，发现OpenSSL官网也介绍得不是很详细，只有这里的介绍：Compilation and Installation - OpenSSLWiki
其官网上的doc栏目，全是一些FAQ的东西，我也是醉了：/docs/index.html 脑子为啥都这么不清楚？试想有一个新的用户，如果想看你官网的话，不是应该最想了解各种安装和编译选项么？程序员们脑子都是浆糊吗？
又搜了搜，发现这里有一些说明：OpenSSL Configure选项说明_昆仑道长的博客-CSDN博客
另外就是上面那个wiki页面也有一些说明：
| Option | Description |
|---|---|
| --prefix=XXX | See PREFIX and OPENSSLDIR in the next section (below). |
| --openssldir=XXX | See PREFIX and OPENSSLDIR in the next section (below). |
| -d | Debug build of the library. Optimizations are disabled (no -O3 or similar) and libefence is used (apt-get install electric-fence or yum install electric-fence). TODO: Any other features? |
| shared | Build a shared object in addition to the static archive. You probably need a RPATH when enabling shared to ensure openssl uses the correct libssl and libcrypto after installation. |
| enable-ec_nistp_64_gcc_128 | Use on little endian platforms when GCC supports __uint128_t. ECDH is about 2 to 4 times faster. Not enabled by default because Configure can't determine it. Enable it if your compiler defines __SIZEOF_INT128__, the CPU is little endian and it tolerates unaligned data access. |
| enable-capieng | Enables the Microsoft CAPI engine on Windows platforms. Used to access the Windows Certificate Store. Also see Using Windows certificate store through OpenSSL on the OpenSSL developer list. |
| no-ssl2 | Disables SSLv2. OPENSSL_NO_SSL2 will be defined in the OpenSSL headers. |
| no-ssl3 | Disables SSLv3. OPENSSL_NO_SSL3 will be defined in the OpenSSL headers. |
| no-comp | Disables compression independent of zlib. OPENSSL_NO_COMP will be defined in the OpenSSL headers. |
| no-idea | Disables IDEA algorithm. Unlike RC5 and MDC2, IDEA is enabled by default |
| no-asm | Disables assembly language routines (and uses C routines) |
| no-dtls | Disables DTLS in OpenSSL 1.1.0 and above |
| no-dtls1 | Disables DTLS in OpenSSL 1.0.2 and below |
| no-shared | Disables shared objects (only a static library is created) |
| no-hw | Disables hardware support (useful on mobile devices) |
| no-engine | Disables hardware support (useful on mobile devices) |
| no-threads | Disables threading support. |
| no-dso | Disables the OpenSSL DSO API (the library offers a shared object abstraction layer). If you disable DSO, then you must disable Engines also |
| no-err | Removes all error function names and error reason text to reduce footprint |
| no-npn/no-nextprotoneg | Disables Next Protocol Negotiation (NPN). Use no-nextprotoneg for 1.1.0 and above; and no-npn otherwise |
| no-psk | Disables Preshared Key (PSK). PSK provides mutual authentication independent of trusted authorities, but it's rarely offered or used |
| no-srp | Disables Secure Remote Password (SRP). SRP provides mutual authentication independent of trusted authorities, but it's rarely offered or used |
| no-ec2m | Used when configuring FIPS Capable Library with a FIPS Object Module that only includes prime curves. That is, use this switch if you use openssl-fips-ecp-2.0.5. |
| no-weak-ssl-ciphers | Disables RC4. Available in OpenSSL 1.1.0 and above. |
| -DXXX | Defines XXX. For example, -DOPENSSL_NO_HEARTBEATS. |
| -DPEDANTIC | Defines PEDANTIC. The library will avoid some undefined behavior, like casting an unaligned byte array to a different pointer type. This define should be used if building OpenSSL with undefined behavior sanitizer (-fsanitize=undefined). |
| -DOPENSSL_USE_IPV6=0 | Disables IPv6. Useful if OpenSSL encounters incorrect or inconsistent platform headers and mistakenly enables IPv6. Must be passed to Configure manually. |
| -DNO_FORK | Defines NO_FORK. Disables calls to fork. Useful for operating systems like AppleTVOS, WatchOS, AppleTVSimulator and WatchSimulator. |
| -Lsomething, -lsomething, -Ksomething, -Wl,something | Linker options, will become part of LDFLAGS. |
| -anythingelse, +anythingelse | Compiler options, will become part of CFLAGS. |
具体来讲，我们在终端里运行：
./Configure –help可以看到有下列提示：
Configuring OpenSSL version 3.0.0 for target –help
Using os-specific seed configuration
Usage: Configure [no-...] [enable- ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]
需要说明的是，上面那个–help并不是我们通常意义下的连字符：-help，这一点也是够奇葩的。哪怕你输入./Configure --help也不行。
看看上面这些提示，算是大概了解了编译选项，但还是有些不了解的，例如-f是什么意思，上面的表里也没写啊。但已经比大部分博客讲得清楚了，例如我注意到很多朋友是这样总结的：
执行Configure是常见参数选项如下：
安装参数：
--openssldir=OPENSSLDIR
安装目录，默认是 /usr/local/ssl 。
--prefix=PREFIX
设置 lib include bin 目录的前缀，默认为 OPENSSLDIR 目录。
--install_prefix=DESTDIR
设置安装时以此目录作为"根"目录，通常用于打包，默认为空。
zlib
zlib-dynamic
no-zlib使用静态的zlib压缩库、使用动态的zlib压缩库、不使用zlib压缩功能。
threads
no-threads是否编译支持多线程的库。默认支持。
shared
no-shared是否生成动态连接库。
asm
no-asm是否在编译过程中使用汇编代码加快编译过程。
enable-sse2
no-sse2启用/禁用SSE2指令集加速。如果你的CPU支持SSE2指令集，就可以打开，否则就要关闭。
gmp
no-gmp启用/禁用GMP库
rfc3779
no-rfc3779启用/禁用实现X509v3证书的IP地址扩展
krb5
no-krb5启用/禁用 Kerberos 5 支持
ssl
no-ssl
ssl2
ssl3
no-ssl2
no-ssl3
tls
no-tls启用/禁用 SSL(包含了SSL2/SSL3) TLS 协议支持。
dso
no-dso启用/禁用调用其它动态链接库的功能。[提示]no-dso仅在no-shared的前提下可用。
禁用选项
no-md2,no-md4,no-mdc2,no-ripemd
摘要算法
no-des,no-rc2,no-rc4,no-rc5,no-idea,no-bf,no-cast,no-camellia
对称加密算法
no-ec,no-dsa,no-ecdsa,no-dh,no-ecdh
不对称加密算法
no-comp
数据压缩算法
no-store
对象存储功能
最后，如果我们想用O0编译，来做一些简单的实验，可以参考上面的网页，用下面这个命令行选项：
./config no-asm -g3 -O0 -fno-omit-frame-pointer -fno-inline-functions然后再运行make（我做实验的时候并不需要install）：
make总体上来说，已经比很多朋友总结得详细了，但我还是有些东西没搞清楚。例如，我看到有些数据集会给出OpenSSL的某个版本的单一的大binary，这个是怎么生成的呢？我还是不太清楚。今天就先总结这么多吧。