diff options
| author | Wilmer van der Gaast <wilmer@gaast.net> | 2012-10-30 23:41:43 +0000 |
|---|---|---|
| committer | Wilmer van der Gaast <wilmer@gaast.net> | 2012-10-30 23:41:43 +0000 |
| commit | 8f976e69b218d89999cc4fd58721243380791fbe (patch) | |
| tree | 98ff544b90f65cf949f5f2a2a6d6bd5c49ac3e09 /lib | |
| parent | addad71d1dd6ac34dd00c2ee0d462f84f9cc2a84 (diff) | |
SSL fixes from Michal Suchanek.
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/ssl_gnutls.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/lib/ssl_gnutls.c b/lib/ssl_gnutls.c index 93601ba6..41a76f09 100644 --- a/lib/ssl_gnutls.c +++ b/lib/ssl_gnutls.c @@ -84,8 +84,10 @@ void ssl_init( void ) { gnutls_certificate_set_x509_trust_file( xcred, global.conf->cafile, GNUTLS_X509_FMT_PEM ); - /* Not needed in GnuTLS 2.11+ but we support older versions for now. */ - gnutls_certificate_set_verify_flags( xcred, GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT ); + /* Not needed in GnuTLS 2.11+ (enabled by default there) so + don't do it (resets possible other defaults). */ + if( !gnutls_check_version( "2.11" ) ) + gnutls_certificate_set_verify_flags( xcred, GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT ); } initialized = TRUE; @@ -107,12 +109,12 @@ void *ssl_connect( char *host, int port, gboolean verify, ssl_input_function fun { struct scd *conn = g_new0( struct scd, 1 ); - conn->fd = proxy_connect( host, port, ssl_connected, conn ); conn->func = func; conn->data = data; conn->inpa = -1; conn->hostname = g_strdup( host ); conn->verify = verify && global.conf->cafile; + conn->fd = proxy_connect( host, port, ssl_connected, conn ); if( conn->fd < 0 ) { |