From 0c9fb2b0412eddf3593a0014b8df268c1279e263 Mon Sep 17 00:00:00 2001 From: Tim Ruehsen Date: Mon, 9 Sep 2013 10:36:09 +0200 Subject: [PATCH] better backport availability for PFS feature --- src/ChangeLog | 6 ++++++ src/gnutls.c | 6 +++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/src/ChangeLog b/src/ChangeLog index 81320ca4..23c210b0 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,9 @@ +2013-09-09 Tim Ruehsen + + * gnutls.c (ssl_connect_wget): changed checking of option "PFS" + to be better prepared for some kinds of backports. + Reported by: Daniel Kahn Gillmor + 2013-10-10 Giuseppe Scrivano * url.c (url_parse): Try to convert UTF-8 URLs to IDN. diff --git a/src/gnutls.c b/src/gnutls.c index 94dfaedd..9b4b1ec0 100644 --- a/src/gnutls.c +++ b/src/gnutls.c @@ -443,9 +443,9 @@ ssl_connect_wget (int fd, const char *hostname) err = gnutls_priority_set_direct (session, "NORMAL:-VERS-SSL3.0", NULL); break; case secure_protocol_pfs: - if (gnutls_check_version("3.2.4")) - err = gnutls_priority_set_direct (session, "PFS", NULL); - else + err = gnutls_priority_set_direct (session, "PFS", NULL); + if (err != GNUTLS_E_SUCCESS) + /* fallback if PFS is not available */ err = gnutls_priority_set_direct (session, "NORMAL:-RSA", NULL); break; default: -- 2.39.2