Re: [Bug-wget] [PATCH] PFS runtime check

[Daniel Kahn Gillmor]

On 09/07/2013 07:01 PM, Giuseppe Scrivano wrote:
> Tim Rühsen <address@hidden> writes:
> 
>>
>> @Giuseppe: Please apply the attached patch.
>>
>> Tim
>>
>> From df5275a504a6d410b084aa9f5023f7638a2731a1 Mon Sep 17 00:00:00 2001
>> From: Tim Ruehsen <address@hidden>
>> Date: Sat, 7 Sep 2013 21:34:37 +0200
>> Subject: [PATCH] PFS runtime check
> 
> Thanks, applied now.


thank you both for your quick work.

After sleeping on it, it occurs to me that some of these changes to the
priority string handling may also end up being backported to older
versions of gnutls, and wget wouldn't be able to take advantage of them
directly in that case.

looking at the docs for gnutls_priority_set_direct(), it says:

  Returns: On syntax error GNUTLS_E_INVALID_REQUEST is returned,
  GNUTLS_E_SUCCESS on success, or an error code.

I haven't tested (sorry!), but it seems like another approach would be
to simply invoke gnutls_priority_set_direct(session, "PFS", NULL); and
if it returns GNUTLS_E_INVALID_REQUEST, then fall back to setting the
"NORMAL:-RSA" string directly.

Knowing that wget could take advantage of such a feature retroactively
might even encourage people doing stable/long-term maintenance of older
versions of GnuTLS to backport this priority string to their stable branch.

Sorry to keep nit-picking on this; i'm very happy to see this option
added to wget.

Regards,

        --dkg

signature.asc
Description: OpenPGP digital signature