details: http://hg.nginx.org/nginx/rev/c256dfdd469d
branches:
changeset: 6489:c256dfdd469d
user: Maxim Dounin <mdounin@mdounin.ru>
date: Thu Mar 31 23:38:34 2016 +0300
description:
SSL: RSA_generate_key() is deprecated in OpenSSL 1.1.0.

OpenSSL removed support for all 40 and 56 bit ciphers.

diffstat:

src/event/ngx_event_openssl.c | 2 +-
src/http/modules/ngx_http_ssl_module.c | 2 +-
src/mail/ngx_mail_ssl_module.c | 2 +-
src/stream/ngx_stream_ssl_module.c | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)

diffs (48 lines):

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -758,7 +758,7 @@ ngx_ssl_rsa512_key_callback(ngx_ssl_conn
return NULL;
}

-#ifndef OPENSSL_NO_DEPRECATED
+#if (OPENSSL_VERSION_NUMBER < 0x10100003L && !defined OPENSSL_NO_DEPRECATED)

if (key == NULL) {
key = RSA_generate_key(512, RSA_F4, NULL, NULL);
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
--- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c
@@ -718,7 +718,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *
SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
}

-#ifndef LIBRESSL_VERSION_NUMBER
+#if (OPENSSL_VERSION_NUMBER < 0x10100001L && !defined LIBRESSL_VERSION_NUMBER)
/* a temporary 512-bit RSA key is required for export versions of MSIE */
SSL_CTX_set_tmp_rsa_callback(conf->ssl.ctx, ngx_ssl_rsa512_key_callback);
#endif
diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
--- a/src/mail/ngx_mail_ssl_module.c
+++ b/src/mail/ngx_mail_ssl_module.c
@@ -421,7 +421,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf,
SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
}

-#ifndef LIBRESSL_VERSION_NUMBER
+#if (OPENSSL_VERSION_NUMBER < 0x10100001L && !defined LIBRESSL_VERSION_NUMBER)
SSL_CTX_set_tmp_rsa_callback(conf->ssl.ctx, ngx_ssl_rsa512_key_callback);
#endif

diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
--- a/src/stream/ngx_stream_ssl_module.c
+++ b/src/stream/ngx_stream_ssl_module.c
@@ -276,7 +276,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf
SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
}

-#ifndef LIBRESSL_VERSION_NUMBER
+#if (OPENSSL_VERSION_NUMBER < 0x10100001L && !defined LIBRESSL_VERSION_NUMBER)
SSL_CTX_set_tmp_rsa_callback(conf->ssl.ctx, ngx_ssl_rsa512_key_callback);
#endif


_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel