diff options
| author | Dan Winship <danw@gnome.org> | 2009-05-08 18:11:20 -0400 |
|---|---|---|
| committer | Dan Winship <danw@gnome.org> | 2009-05-08 18:11:20 -0400 |
| commit | 4d8e5c85894ade47189612fbafd0410792de2dbc (patch) | |
| tree | 83baf71de1d0cc5f2249b548b6442edb23920b9b | |
| parent | 8da342d927dfd5f991d6b4f18509acdf0960245a (diff) | |
| download | libsoup-4d8e5c85894ade47189612fbafd0410792de2dbc.tar.gz | |
Attempt better compatibility with non-TLS1.1 https servers.
Try to use the (not-yet-widely-deployed) SSL3_RECORD_VERSION option in
gnutls to make it handshake according to the backward-compatibility
recommendations in the TLS spec. If that fails, fall back to just
disabling TLS1.1. Should hopefully help us to work better with servers
that freak out if you even suggest using TLS1.1.
Fix based on a Pidgin patch from Martin von Gagern.
http://bugzilla.gnome.org/show_bug.cgi?id=581342
| -rw-r--r-- | libsoup/soup-gnutls.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libsoup/soup-gnutls.c b/libsoup/soup-gnutls.c index b5a5f32a..d3d410df 100644 --- a/libsoup/soup-gnutls.c +++ b/libsoup/soup-gnutls.c @@ -446,7 +446,9 @@ soup_ssl_wrap_iochannel (GIOChannel *sock, gboolean non_blocking, if (ret) goto THROW_CREATE_ERROR; - if (gnutls_set_default_priority (session) != 0) + /* See http://bugzilla.gnome.org/show_bug.cgi?id=581342 */ + if (gnutls_priority_set_direct (session, "NORMAL:%SSL3_RECORD_VERSION", NULL) != 0 && + gnutls_priority_set_direct (session, "NORMAL:!VERS-TLS1.1", NULL) != 0) goto THROW_CREATE_ERROR; if (gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, |