Commit 5f008715 authored by Dan Winship's avatar Dan Winship
Browse files

gnutls: update default priority string and fallback rules

Change the default "priority" string from "NORMAL:%COMPAT" to
servers won't care either way, but apparently some servers have been
incorrectly updated for POODLE-safeness by rejecting all handshakes
with SSL 3.0 in the version field [which had long been recommended for
compatibility reasons], even if the handshake offered to negotiate TLS
versions too.)

Change the fallback/"ssl3" priority code so that it never includes
%LATEST_RECORD_VERSION, but does include %COMPAT even if the default
priority doesn't (eg, because it was overridden with
parent c12b8ec6
......@@ -197,6 +197,8 @@ g_tls_connection_gnutls_init (GTlsConnectionGnutls *gnutls)
/* First field is "fallback", second is "allow unsafe rehandshaking" */
static gnutls_priority_t priorities[2][2];
static void
g_tls_connection_gnutls_init_priorities (void)
......@@ -207,12 +209,12 @@ g_tls_connection_gnutls_init_priorities (void)
base_priority = g_getenv ("G_TLS_GNUTLS_PRIORITY");
if (!base_priority)
base_priority = "NORMAL:%COMPAT";
base_priority = DEFAULT_BASE_PRIORITY;
ret = gnutls_priority_init (&priorities[FALSE][FALSE], base_priority, NULL);
g_warning ("G_TLS_GNUTLS_PRIORITY is invalid; ignoring!");
base_priority = "NORMAL:%COMPAT";
base_priority = DEFAULT_BASE_PRIORITY;
gnutls_priority_init (&priorities[FALSE][FALSE], base_priority, NULL);
......@@ -236,8 +238,21 @@ g_tls_connection_gnutls_init_priorities (void)
fallback_priority = g_strdup_printf ("%s:!VERS-TLS-ALL:+VERS-%s",
gchar *cleaned_base, *p, *rest;
/* fallback_priority should be based on base_priority, except
* that we don't want %LATEST_RECORD_VERSION in it.
cleaned_base = g_strdup (base_priority);
p = strstr (cleaned_base, ":%LATEST_RECORD_VERSION");
if (p)
rest = p + strlen (":%LATEST_RECORD_VERSION");
memmove (p, rest, strlen (rest) + 1);
fallback_priority = g_strdup_printf ("%s:%%COMPAT:!VERS-TLS-ALL:+VERS-%s",
gnutls_protocol_get_name (fallback_proto));
fallback_unsafe_rehandshake_priority = g_strdup_printf ("%s:%%UNSAFE_RENEGOTIATION",
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment