Bitrot: OpenSSL 1.1.0-dev drops EXPORT ciphers and ephemeral RSA

diff --git a/postfix/src/tls/tls_client.c b/postfix/src/tls/tls_client.c
index 039e704823c29460f97adadc64dba4e0480316b6..23ef24786948cadb3068ed4b4b15369bc94d26cc 100644 (file)
--- a/postfix/src/tls/tls_client.c
+++ b/postfix/src/tls/tls_client.c
@@ -421,12 +421,17 @@ TLS_APPL_STATE *tls_client_init(const TLS_CLIENT_INIT_PROPS *props)
        return (0);
     }
 
+    /*
+     * 2015-12-05: Ephemeral RSA removed from OpenSSL 1.1.0-dev
+     */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     /*
      * According to the OpenSSL documentation, temporary RSA key is needed
      * export ciphers are in use. We have to provide one, so well, we just do
      * it.
      */
     SSL_CTX_set_tmp_rsa_callback(client_ctx, tls_tmp_rsa_cb);
+#endif
 
     /*
      * Finally, the setup for the server certificate checking, done "by the

diff --git a/postfix/src/tls/tls_rsa.c b/postfix/src/tls/tls_rsa.c
index 1dfe266b38c30f4c34a366a289148a091f60206e..5a19721e9e90f709af6016e23ad3c08a7d4c5557 100644 (file)
--- a/postfix/src/tls/tls_rsa.c
+++ b/postfix/src/tls/tls_rsa.c
@@ -53,6 +53,11 @@
 #define TLS_INTERNAL
 #include <tls.h>
 
+ /*
+  * 2015-12-05: Ephemeral RSA removed from OpenSSL 1.1.0-dev
+  */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+
 /* tls_tmp_rsa_cb - call-back to generate ephemeral RSA key */
 
 RSA    *tls_tmp_rsa_cb(SSL *unused_ssl, int export, int keylength)
@@ -89,6 +94,7 @@ RSA    *tls_tmp_rsa_cb(SSL *unused_ssl, int export, int keylength)
 
     return (rsa_tmp);
 }
+#endif /* OPENSSL_VERSION_NUMBER */
 
 #ifdef TEST
 
@@ -96,8 +102,12 @@ RSA    *tls_tmp_rsa_cb(SSL *unused_ssl, int export, int keylength)
 
 int     main(int unused_argc, char *const argv[])
 {
+    int     ok = 0;
+    /*
+     * 2015-12-05: Ephemeral RSA removed from OpenSSL 1.1.0-dev
+     */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     RSA    *rsa;
-    int     ok;
 
     msg_vstream_init(argv[0], VSTREAM_ERR);
 
@@ -110,6 +120,7 @@ int     main(int unused_argc, char *const argv[])
     /* Non-export or unexpected bit length should fail */
     ok = ok && tls_tmp_rsa_cb(0, 0, 512) == 0;
     ok = ok && tls_tmp_rsa_cb(0, 1, 1024) == 0;
+#endif
 
     return ok ? 0 : 1;
 }

diff --git a/postfix/src/tls/tls_server.c b/postfix/src/tls/tls_server.c
index abb8ff752d2665e1cc355b8cc8e68ecbdb0ad02c..720b0b8ac20dc7edaf445ebe22db11db5b3c39f1 100644 (file)
--- a/postfix/src/tls/tls_server.c
+++ b/postfix/src/tls/tls_server.c
@@ -551,12 +551,17 @@ TLS_APPL_STATE *tls_server_init(const TLS_SERVER_INIT_PROPS *props)
        return (0);
     }
 
+    /*
+     * 2015-12-05: Ephemeral RSA removed from OpenSSL 1.1.0-dev
+     */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     /*
      * According to OpenSSL documentation, a temporary RSA key is needed when
      * export ciphers are in use, because the certified key cannot be
      * directly used.
      */
     SSL_CTX_set_tmp_rsa_callback(server_ctx, tls_tmp_rsa_cb);
+#endif
 
     /*
      * Diffie-Hellman key generation parameters can either be loaded from