openssl with EC on CentOS 6.4

I need your help to rebuild an openssl RPM package with EC (Elliptic Curves).

The target OS is CentOS 6.4. In CentOS, EC (elliptic curves) is disabled due to patent fears.
The strategy is to
1) Download the "official" CentOS source package
2) Modify the .spec file to enable elliptic curves
3) Rebuild the package using rpmbuild

Right now the rebuild compiles about 95% through.

I need your help to eliminate the errors.

The build is done on a fresh Amazon Cloud server which allows anyone to precisely duplicate every step taken.

# 1. Log into AWS (Amazon Web Services) and create a public key. http://aws.amazon.com/
# 2. Download your public key and install into your local client e.g. putty or ssh.
# 3. Instantiate this CentOS 6.4 machine: https://aws.amazon.com/marketplace/pp/B00A6L6F9I
# 4. Log into your new Centos 6.4 using ssh or putty, update and install a few packages:

yum -y update  # Update all packages on new machine
yum -y groupinstall 'Development tools'
yum -y install zlib-devel
yum -y install krb5-devel

cat /etc/centos-release
# CentOS release 6.4 (Final)

uname -rpo
# 2.6.32-279.el6.x86_64 x86_64 GNU/Linux

gcc --version
# gcc 4.4.7 20120313 (Red Hat 4.4.7-3)

# 5. Now we are ready for our first rebuild of openssl. We will do the build as a a new user "abcd"

userdel -rf abcd ; useradd abcd ; su abcd # Wipe user abcd, create fresh user abcd, become user abcd
echo "%_topdir /home/$USER/rpmbuild" > ~/.rpmmacros ; echo "%packager Test User <[email protected]>" >> ~/.rpmmacros  # Tell rpm where to install files and fake id
echo "%_query_all_fmt %%{name}-%%{version}-%%{release}.%%{arch}" >> ~/.rpmmacros # Tell rpm the architecture
cd ~ ; curl -O http://vault.centos.org/6.4/os/Source/SPackages/openssl-1.0.0-27.el6.src.rpm # Get openssl source
rpm --install openssl-1.0.0-27.el6.src.rpm 1>e1 2>e2 # Extract the source package to /rpmbuild/SOURCES
cd ~/rpmbuild/SPECS # This is where the package .spec file is extracted to
rpmbuild -bb openssl.spec 1>e1 2>e2 &    # Rebuild the package using the edited .spec file

jobs  # A command to check if the compile is still running
# [1]+  Running  rpmbuild -bb openssl.spec > e1 2> e2 &

tail -f e1 # or "tail -f e2" # A command to watch the build progress

less -i e2  # Command to let you browse the build errors. Search for "error" with /error

# This build completes successfully with no build errors, proving that we have a good build environment.

# 6. Now we are ready to do a second rebuild. This time we tun on elliptic curves.

cd ~/rpmbuild/SPECS # This is where the .spec file is that we want to change
sed -i -e "s/no-ec/enable-ec/; s/no-ecdh/ /; s/no-ecdsa/ /" ~/rpmbuild/SPECS/openssl.spec
sed -i -e "s/^Source1: hobble-openssl/#&/; s/^%.SOURCE1. /#&/" ~/rpmbuild/SPECS/openssl.spec # Edit the .spec file

# The changes are done, and we can start the second rebuild

rpmbuild -bb openssl.spec 1>e1 2>e2 &    # Rebuild the package using the edited .spec file

jobs # Use this command to see when the build is done.

less -i e2 # Command to look at the build errors file. Use /error to search for errors.

# ====================================================================
# =========================== After the build ========================
# ====================================================================

We made the following five changes (see the sed lines above) to enable elliptic curves:

s/no-ec/enable-ec/
s/no-ecdh/ /
s/no-ecdsa/ /
s/^Source1: hobble-openssl/#&/
s/^%.SOURCE1. /#&/

When the package is built with these five changes, there are build errors.

Build errors here, near the end of the file: http://pastebin.com/8aGxEd6n

I find these errors hard to resolve due to my inexperience - this is where I need help.

p_lib.c:318: error: expected declaration specifiers or '...' before 'EC_KEY'

After looking at gcc preprocessor output (gcc -E) I concluded that EC_KEY is undefined.

I found this reference handy: http://fossies.org/dox/openssl-1.0.1e/index.html

EC_KEY is defined in /crypto/include/ec.h

If I manually edit p_lib.c to include ec.h, this error vanishes.

So, for some reason, ec.h is not included in p_lib.c. I wonder why and how to properly fix it.

Comments and suggestions welcome.

Notes

tkil's (freenode #openssl) build file: http://pastebin.com/W9yhbCwt
Note how he adds /crypto/include (the file i'm missing) into the makefile...
perl -i~ -plwe 's!^(CFLAG=.*$)!$1 -DPURIFY -I /opt/crypto/include!' Makefile

I also tried an experimental build where I deleted everything in rpmbuild/SOURCES/hobble-openssl.
hobble-openssl looks for all EC source files and deletes them. I did not edit openssl.spec in /rpmbuild/SPECS.
This experiment built successfully, which tells me that the problem is likely not due to the presence/absence of hobble-openssl.