[bug #67966] certain options override gnutls system configuration
anonymous <[email protected]> Tue, 27 Jan 2026 04:35:16 -0500 (EST)
| Newsgroups | gmane.comp.web.wget.general |
|---|---|
| Message-ID | <[email protected]> |
--8323329-846930886-1769506516=:2683343 Content-Type: TEXT/plain; CHARSET=utf-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Content-Disposition: inline URL:=0A <https://savannah.gnu.org/bugs/?67966>=0A=0A Summa= ry: certain options override gnutls system configuration=0A = Group: GNU Wget=0A Submitter: None=0A Submit= ted: Tue 27 Jan 2026 09:35:12 AM UTC=0A Category: Program Lo= gic=0A Severity: 3 - Normal=0A Priority: 5 - = Normal=0A Status: None=0A Privacy: Public= =0A Assigned to: None=0A Originator Name: Alexander Sos= edkin=0A Originator Email: [email protected]=0A Open/= Closed: Open=0A Discussion Lock: Unlocked=0A Releas= e: trunk=0A Operating System: GNU/Linux=0A Reproducibility: = Every Time=0A Fixed Release: None=0A Planned Release: Non= e=0A Regression: No=0A Work Required: None=0A = Patch Included: No=0A=0A=0A _________________________________________= ______________=0A=0AFollow-up Comments:=0A=0A=0A---------------------------= ----------------------------=0ADate: Tue 27 Jan 2026 09:35:12 AM UTC By: An= onymous=0AAs of the current git commit 3388a22b10dbda015005ddfb8fe7fc1c04f6= e069=0Asrc/gnutls.c's set_prio_default does not modify gnutls priority stri= ngs=0Acorrectly.=0Awget should not override the system-wide gnutls policy e= ntirely,=0Abut rather tweak just the aspects it needs tweaked.=0A=0AExample= :=0A=0A case secure_protocol_tlsv1_3:=0A#if GNUTLS_VERSION_NUMBER >=3D 0= x030603=0A err =3D gnutls_priority_set_direct (session,=0A"NORMAL:-VER= S-SSL3.0:+VERS-TLS1.3:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-TLS1.2",=0ANULL);=0A = break;=0A=0ANORMAL is gnutls' compiled-in default which hasn't been up= dated in a while.=0AOn systems defaulting to a tighter priority string, suc= h as Fedora or RHEL,=0Athis relaxes it back to gnutls defaults.=0A=0AAn est= ablised, recommended way to alter cryptographic defaults=0Athat works with = every configuration format of gnutls is=0A`gnutls_set_default_priority_appe= nd()`.=0ASay, forcing TLS 1.3 specifically could be done with a=0A`-VERS-TL= S-ALL:+VERS-TLS-1.2`,=0Awhile forcing TLS 1.3 or newer could indeed be done= =0Awith a `-VERS-SSL3.0:+VERS-TLS1.3:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-TLS1.2= `.=0A=0AAdditionally, gnutls_session_enable_compatibility_mode(session) sho= uld not=0Areally be used.=0A=0A=0A=0A=0A=0A=0A=0A ______________________= _________________________________=0A=0AReply to this item at:=0A=0A <https= ://savannah.gnu.org/bugs/?67966>=0A=0A_____________________________________= __________=0AMessage sent via Savannah=0Ahttps://savannah.gnu.org/=0A --8323329-846930886-1769506516=:2683343 Content-Type: APPLICATION/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCaXiG1AAKCRCqLAuaBUf3 ThU0AQCN9pZzH61KwR3FRVLhfXBisyZH38+MQeqKrsrIVV29cAD/Ts2y1iykDAIa 7D71snHaFmhBnkB82gBifMgUrTn1qQE= =iH0E -----END PGP SIGNATURE----- --8323329-846930886-1769506516=:2683343--