Hello!

On Mon, Jul 07, 2014 at 03:02:14PM -0700, Piotr Sikora wrote:

> Hey Maxim,
>
> > It's marked as deprecated in master branch, but not in the latest
> > release. Try looking into the latest release docs, 1.0.1h -
> > doc/crypto/RSA_generate_key.pod doesn't even mention
> > RSA_generate_key_ex.
>
> It's been deprecated before OpenSSL-0.9.8 release, see git history [1].

Correct link is:
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9224c717711eefb30038c9b37c69795dda93c9a

And it looks like the only rationale for deprecation is a new
interface introduced.

> OpenSSL's documentation is terrible source of information and that's
> not news - nginx itself is using a lot of undocumented functions,
> especially in the OCSP stapling code.

It's not about quality of OpenSSL's documentation, it's about the
fact that OpenSSL itself doesn't care about said deprecation.

> > Sure, it can and likely will be helpful. In this particular case
> > the replacement code seems to be too long though. For
> > development needs, it will probably be enough to just return NULL
> > if OPENSSL_NO_DEPRECATED is defined.
>
> Sigh, I really don't think that the amount of code is really a problem
> here... But if you're really unhappy with it, maybe let's just remove

The amount of code is certainly a problem, and it indicates that
the "new" interface, uhm, have problems.

> the callback altogether? It's not like it's used with nginx's default
> ciphers list and I'm not aware of anything since Windows NT 4.0 that
> would require it.

I don't think it's time to remove it, but as I previously said, I
will be fine with something like this:

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -652,12 +652,16 @@ ngx_ssl_rsa512_key_callback(ngx_ssl_conn
{
static RSA *key;

+#ifndef OPENSSL_NO_DEPRECATED
+
if (key_length == 512) {
if (key == NULL) {
key = RSA_generate_key(512, RSA_F4, NULL, NULL);
}
}

+#endif
+
return key;
}


This won't change anything for normal builds, but will allow test
builds with OPENSSL_NO_DEPRECATED defined.

--
Maxim Dounin
http://nginx.org/

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel