OpenSSL 1.0.1g and sendmail/postfix TLS handshakes

[Stephen Borrill <netbsd%precedence.co.uk@localhost>]

The upgrade to OpenSSL 1.0.1g included more than just the Heartbleed fix. 
A workaround for TLS v1.2 interoperability with F5 load-balancers was 
sneaked in too. This causes problems with some IronPort email appliances 
and unfortunately, these seem to be annoying common. Sendmail just fails 
with TLS handshake failed and does not fall back to plain text.

There are a couple of workarounds:
1) Compile OpenSSL with #define TLSEXT_TYPE_padding 21 commented out
2) Build sendmail with -D_FFR_TLS_1 and then use ClientSSLOptions to 
disable TLS v1.2 (postfix users would need to handle this differently).

Opinions?

Refs:
https://groups.google.com/forum/#!topic/comp.mail.sendmail/SXR51LaIB_U
http://postfix.1071664.n5.nabble.com/OpenSSL-1-0-1g-and-Ironport-SMTP-appliances-interop-issue-td66873.html
http://www.mail-archive.com/openssl-users%openssl.org@localhost/msg73478.html

--
Stephen