PFS runtime check

diff --git a/src/ChangeLog b/src/ChangeLog
index ee7a53e412a07a1bbaa06e254347238a156788da..787c9c6067b9976a6255c28b801a098442c13eb7 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2013-09-07  Tim Ruehsen  <tim.ruehsen@gmx.de>
+
+       * gnutls.c (ssl_connect_wget): use gnutls_check_version()
+         to check if option "PFS" is available
+         Reported by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+
 2013-09-03  Tim Ruehsen  <tim.ruehsen@gmx.de>
 
        * main.c: Add new value 'PFS' to --secure-protocol to

diff --git a/src/gnutls.c b/src/gnutls.c
index ce61d065a4b96db110ce7dfc6ecf0e200c03c089..94dfaedd0f39b3211a2347196f815ce2d4a37a9c 100644 (file)
--- a/src/gnutls.c
+++ b/src/gnutls.c
@@ -443,11 +443,10 @@ ssl_connect_wget (int fd, const char *hostname)
       err = gnutls_priority_set_direct (session, "NORMAL:-VERS-SSL3.0", NULL);
       break;
     case secure_protocol_pfs:
-#if defined (GNUTLS_VERSION_NUMBER) && GNUTLS_VERSION_NUMBER >= 0x030204
-      err = gnutls_priority_set_direct (session, "PFS", NULL);
-#else
-      err = gnutls_priority_set_direct (session, "NORMAL:-RSA", NULL);
-#endif
+      if (gnutls_check_version("3.2.4"))
+        err = gnutls_priority_set_direct (session, "PFS", NULL);
+      else
+        err = gnutls_priority_set_direct (session, "NORMAL:-RSA", NULL);
       break;
     default:
       abort ();