lib-ssl-iostream: Use RSA_generate_key_ex() if it exists

This avoids deprecation warnings about RSA_generate_key() in OpenSSL v1.1.

diff --git a/m4/ssl.m4 b/m4/ssl.m4
index 6cd63291046088b7f3efc13ac3151623c9139d6a..4c98095a129d566f1af0235a194c7d429a1ce7f3 100644 (file)
--- a/m4/ssl.m4
+++ b/m4/ssl.m4
@@ -89,6 +89,9 @@ AC_DEFUN([DOVECOT_SSL], [
       AC_CHECK_LIB(ssl, SSL_COMP_free_compression_methods, [
         AC_DEFINE(HAVE_SSL_COMP_FREE_COMPRESSION_METHODS,, [Build with SSL_COMP_free_compression_methods() support])
       ],, $SSL_LIBS)
+      AC_CHECK_LIB(ssl, RSA_generate_key_ex, [
+        AC_DEFINE(HAVE_RSA_GENERATE_KEY_EX,, [Build with RSA_generate_key_ex() support])
+      ],, $SSL_LIBS)
       AC_CHECK_LIB(ssl, [EVP_PKEY_CTX_new_id], [have_evp_pkey_ctx_new_id="yes"],, $SSL_LIBS)
       AC_CHECK_LIB(ssl, [EC_KEY_new], [have_ec_key_new="yes"],, $SSL_LIBS)
       if test "$have_evp_pkey_ctx_new_id" = "yes" && test "$have_ec_key_new" = "yes"; then

diff --git a/src/lib-ssl-iostream/iostream-openssl-context.c b/src/lib-ssl-iostream/iostream-openssl-context.c
index 10f44107f828e197c3d3f96443e2a51c9fa9de73..b97009c80f5a589164f7f1267ba5e1664637772e 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl-context.c
+++ b/src/lib-ssl-iostream/iostream-openssl-context.c
@@ -29,7 +29,22 @@ static int ssl_iostream_init_global(const struct ssl_iostream_settings *set,
 static RSA *ssl_gen_rsa_key(SSL *ssl ATTR_UNUSED,
                            int is_export ATTR_UNUSED, int keylength)
 {
+#ifdef HAVE_RSA_GENERATE_KEY_EX
+       BIGNUM *bn = BN_new();
+       RSA *rsa = RSA_new();
+
+       if (bn != NULL && BN_set_word(bn, RSA_F4) != 0 &&
+           RSA_generate_key_ex(rsa, keylength, bn, NULL) != 0)
+               return rsa;
+
+       if (bn != NULL)
+               BN_free(bn);
+       if (rsa != NULL)
+               RSA_free(rsa);
+       return NULL;
+#else
        return RSA_generate_key(keylength, RSA_F4, NULL, NULL);
+#endif
 }
 
 static DH *ssl_tmp_dh_callback(SSL *ssl ATTR_UNUSED,