Please review Tim
From a0329cf593149982bab32cea6021b46c1573d152 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim Rühsen?= <[email protected]> Date: Mon, 24 Nov 2014 12:05:26 +0100 Subject: [PATCH] GnuTLS support for --secure-protocol=TLSv1_1|TLSv1_2
The code seemed to be forgotten. Also added a message before aborting Wget in such a case. --- src/ChangeLog | 8 ++++++++ src/gnutls.c | 25 +++++++++++++++++++++---- src/openssl.c | 10 ++++++---- 3 files changed, 35 insertions(+), 8 deletions(-) diff --git a/src/ChangeLog b/src/ChangeLog index d466281..902d5ee 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,5 +1,13 @@ 2014-11-24 Tim Ruehsen <[email protected]> + * gnutls.c (ssl_connect_wget): Implement missing code for + --secure-protocol=TLSv1_1|TLSv1_2, print message before abort() + for missing protocol implementations. + * openssl.c (ssl_init): Print message before abort() for + missing protocol implementations. + +2014-11-24 Tim Ruehsen <[email protected]> + * retrc.c: Fix possibly uninitialized variable 2014-11-24 Tim Ruehsen <[email protected]> diff --git a/src/gnutls.c b/src/gnutls.c index 080b5a0..0ce6b36 100644 --- a/src/gnutls.c +++ b/src/gnutls.c @@ -432,7 +432,7 @@ ssl_connect_wget (int fd, const char *hostname) #endif struct wgnutls_transport_context *ctx; gnutls_session_t session; - int err,alert; + int err; const char *str; gnutls_init (&session, GNUTLS_CLIENT); @@ -468,6 +468,12 @@ ssl_connect_wget (int fd, const char *hostname) case secure_protocol_tlsv1: err = gnutls_priority_set_direct (session, "NORMAL:-VERS-SSL3.0", NULL); break; + case secure_protocol_tlsv1_1: + err = gnutls_priority_set_direct (session, "NORMAL:-VERS-SSL3.0:-VERS-TLS1.0", NULL); + break; + case secure_protocol_tlsv1_2: + err = gnutls_priority_set_direct (session, "NORMAL:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1", NULL); + break; case secure_protocol_pfs: err = gnutls_priority_set_direct (session, "PFS:-VERS-SSL3.0", NULL); if (err != GNUTLS_E_SUCCESS) @@ -475,6 +481,8 @@ ssl_connect_wget (int fd, const char *hostname) err = gnutls_priority_set_direct (session, "NORMAL:-RSA:-VERS-SSL3.0", NULL); break; default: + logprintf (LOG_NOTQUIET, _("GnuTLS: unimplemented 'secure-protocol' option value %d\n"), opt.secure_protocol); + logprintf (LOG_NOTQUIET, _("Please report this issue to [email protected]\n")); abort (); } #else @@ -488,15 +496,24 @@ ssl_connect_wget (int fd, const char *hostname) allowed_protocols[0] = GNUTLS_SSL3; err = gnutls_protocol_set_priority (session, allowed_protocols); break; - case secure_protocol_tlsv1: allowed_protocols[0] = GNUTLS_TLS1_0; allowed_protocols[1] = GNUTLS_TLS1_1; allowed_protocols[2] = GNUTLS_TLS1_2; err = gnutls_protocol_set_priority (session, allowed_protocols); break; - + case secure_protocol_tlsv1_1: + allowed_protocols[0] = GNUTLS_TLS1_1; + allowed_protocols[2] = GNUTLS_TLS1_2; + err = gnutls_protocol_set_priority (session, allowed_protocols); + break; + case secure_protocol_tlsv1_2: + allowed_protocols[2] = GNUTLS_TLS1_2; + err = gnutls_protocol_set_priority (session, allowed_protocols); + break; default: + logprintf (LOG_NOTQUIET, _("GnuTLS: unimplemented 'secure-protocol' option value %d\n"), opt.secure_protocol); + logprintf (LOG_NOTQUIET, _("Please report this issue to [email protected]\n")); abort (); } #endif @@ -560,7 +577,7 @@ ssl_connect_wget (int fd, const char *hostname) if (err == GNUTLS_E_WARNING_ALERT_RECEIVED || err == GNUTLS_E_FATAL_ALERT_RECEIVED) { - alert = gnutls_alert_get (session); + gnutls_alert_description_t alert = gnutls_alert_get (session); str = gnutls_alert_get_name (alert); if (str == NULL) str = "(unknown)"; diff --git a/src/openssl.c b/src/openssl.c index 3a2ee5f..03e7dd4 100644 --- a/src/openssl.c +++ b/src/openssl.c @@ -229,13 +229,15 @@ ssl_init (void) break; #else case secure_protocol_tlsv1_1: - logprintf (LOG_NOTQUIET, _("Your OpenSSL version is too old to support TLSv1.1\n")); - goto error; + logprintf (LOG_NOTQUIET, _("Your OpenSSL version is too old to support TLSv1.1\n")); + goto error; case secure_protocol_tlsv1_2: - logprintf (LOG_NOTQUIET, _("Your OpenSSL version is too old to support TLSv1.2\n")); - goto error; + logprintf (LOG_NOTQUIET, _("Your OpenSSL version is too old to support TLSv1.2\n")); + goto error; #endif default: + logprintf (LOG_NOTQUIET, _("OpenSSL: unimplemented 'secure-protocol' option value %d\n"), opt.secure_protocol); + logprintf (LOG_NOTQUIET, _("Please report this issue to [email protected]\n")); abort (); } -- 2.1.3
signature.asc
Description: This is a digitally signed message part.
