From: Tim Ruehsen <tim.ruehsen@gmx.de>
Date: Mon, 9 Sep 2013 08:36:09 +0000 (+0200)
Subject: better backport availability for PFS feature
X-Git-Tag: v1.15~15
X-Git-Url: http://sjero.net/git/?p=wget;a=commitdiff_plain;h=0c9fb2b0412eddf3593a0014b8df268c1279e263

better backport availability for PFS feature
---

diff --git a/src/ChangeLog b/src/ChangeLog
index 81320ca4..23c210b0 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2013-09-09  Tim Ruehsen  <tim.ruehsen@gmx.de>
+
+	* gnutls.c (ssl_connect_wget): changed checking of option "PFS"
+	  to be better prepared for some kinds of backports.
+	  Reported by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+
 2013-10-10  Giuseppe Scrivano  <gscrivan@redhat.com>
 
 	* url.c (url_parse): Try to convert UTF-8 URLs to IDN.
diff --git a/src/gnutls.c b/src/gnutls.c
index 94dfaedd..9b4b1ec0 100644
--- a/src/gnutls.c
+++ b/src/gnutls.c
@@ -443,9 +443,9 @@ ssl_connect_wget (int fd, const char *hostname)
       err = gnutls_priority_set_direct (session, "NORMAL:-VERS-SSL3.0", NULL);
       break;
     case secure_protocol_pfs:
-      if (gnutls_check_version("3.2.4"))
-        err = gnutls_priority_set_direct (session, "PFS", NULL);
-      else
+      err = gnutls_priority_set_direct (session, "PFS", NULL);
+      if (err != GNUTLS_E_SUCCESS)
+        /* fallback if PFS is not available */
         err = gnutls_priority_set_direct (session, "NORMAL:-RSA", NULL);
       break;
     default: