Avoid use of deprecated RSA_generate_key() function.

[Palatinux]

When Openssl 1.0.1 is compiled with 'configure -no-deprecated' OpenVPN produces this error during build:

''ssl.c:367:46: error: 'RSA_F4' undeclared (first use in this function)''

Deprecated RSA_generate_key() should also be replaced with the RSA_generate_key_ex() function.

Example: RSA_generate_key_ex(rsa, 4096, e, NULL)

Thank you,

The Fortress Linux Security Team.
​http://www.fortresslinux.org

[Gert Döring]

shall we fix this in 2.3.1? I have no idea what this is about, but we should at least decide something

[plaisthos]

FYI the android version of openssl is also build with --no-depracted has uses a compat/rsa-generate.c to include the old function to build.

[Samuli Seppänen]

If I understood this correctly, Fortresslinux OpenSSL packages have been compiled without support for deprecated (=compatibility) functions. In our case, one such function is RSA_generate_key(), and we should switch to RSA_generate_key_ex() instead. The deprecated function is called in src/openvpn/ssl_openssl.c.

Switching to the non-deprecated (_ex) function should be safe, as it's included in OpenSSL 0.9.8 and later.

[Samuli Seppänen]

I think we should fix this in 2.4 at latest, or even in the next 2.3 release.

[Gert Döring]

does syzzer have a trac account? might be better to give the ticket to him than andj

[Gert Döring]

Zap!

For 2.3, this has been changed to RSA_generate_key_ex(), and for 2.4, the whole code path is gone as it would only be used for weak ciphers that we don't want in the first place.