Bug 4599 pt4: Disable RSA weak ephemeral key exchange for OpenSSL-1.1

From OpenSSL  changeLog:
     Remove support for all 40 and 56 bit ciphers.  This includes all the export
     ciphers who are no longer supported and drops support the ephemeral RSA key
     exchange. The LOW ciphers currently doesn't have any ciphers in it.
     [Kurt Roeckx]

OpenSSL 1.1.0  drops EXPORT ciphers and ephemeral RSA. The ssl_temp_rsa_cb used
here. The OpenSSL manual for this function is:
  https://wiki.openssl.org/index.php/Manual:SSL_CTX_set_tmp_rsa_callback(3)

diff --git a/src/ssl/support.cc b/src/ssl/support.cc
index b0d17f88c58bc114a33ed57da844cb24c7bd091e..17cb7f8fb74ed1925d6a80b25ec93d0ef96c4faa 100644 (file)
--- a/src/ssl/support.cc
+++ b/src/ssl/support.cc
@@ -96,7 +96,7 @@ ssl_ask_password(SSL_CTX * context, const char * prompt)
     }
 }
 
-/// \ingroup ServerProtocolSSLInternal
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L)
 static RSA *
 ssl_temp_rsa_cb(SSL * ssl, int anInt, int keylen)
 {
@@ -146,6 +146,16 @@ ssl_temp_rsa_cb(SSL * ssl, int anInt, int keylen)
 
     return rsa;
 }
+#endif
+
+static void
+maybeSetupRsaCallback(Security::ContextPointer &ctx)
+{
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L)
+    debugs(83, 9, "Setting RSA key generation callback.");
+    SSL_CTX_set_tmp_rsa_callback(ctx.get(), ssl_temp_rsa_cb);
+#endif
+}
 
 int Ssl::asn1timeToString(ASN1_TIME *tm, char *buf, int len)
 {
@@ -523,8 +533,7 @@ configureSslContext(Security::ContextPointer &ctx, AnyP::PortCfg &port)
         }
     }
 
-    debugs(83, 9, "Setting RSA key generation callback.");
-    SSL_CTX_set_tmp_rsa_callback(ctx.get(), ssl_temp_rsa_cb);
+    maybeSetupRsaCallback(ctx);
 
     port.secure.updateContextEecdh(ctx);
     port.secure.updateContextCa(ctx);
@@ -676,8 +685,7 @@ Ssl::InitClientContext(Security::ContextPointer &ctx, Security::PeerOptions &pee
         }
     }
 
-    debugs(83, 9, "Setting RSA key generation callback.");
-    SSL_CTX_set_tmp_rsa_callback(ctx.get(), ssl_temp_rsa_cb);
+    maybeSetupRsaCallback(ctx);
 
     if (fl & SSL_FLAG_DONT_VERIFY_PEER) {
         debugs(83, 2, "NOTICE: Peer certificates are not verified for validity!");