gnutls_session_enable_compatibility_mode() is equivalent to %COMPAT priority string.

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index d621e138eff834739ce9f1b206c9580298ca6caa..eb19b6c5a6cd564b6d0d159d9c001b0ff2b7fb10 100644 (file)
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -595,6 +595,11 @@ struct gnutls_priority_st
   unsigned int additional_verify_flags;
 };
 
+#define ENABLE_COMPAT(x) \
+              (x)->no_padding = 1; \
+              (x)->allow_large_records = 1; \
+              (x)->allow_key_usage_violation = 1; \
+              (x)->allow_weak_keys = 1
 
 /* DH and RSA parameters types.
  */

diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index 704bc0a5887a53ceafe87c60aa6b293df5d3a496..9c0eed95b0a341a6849ea9a4487200879c202c81 100644 (file)
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -978,10 +978,7 @@ gnutls_priority_init (gnutls_priority_t * priority_cache,
         {
           if (strcasecmp (&broken_list[i][1], "COMPAT") == 0)
             {
-              (*priority_cache)->no_padding = 1;
-              (*priority_cache)->allow_large_records = 1;
-              (*priority_cache)->allow_key_usage_violation = 1;
-              (*priority_cache)->allow_weak_keys = 1;
+              ENABLE_COMPAT((*priority_cache));
             }
           else if (strcasecmp (&broken_list[i][1], "NO_EXTENSIONS") == 0)
             {

diff --git a/lib/gnutls_state.c b/lib/gnutls_state.c
index c9c09cef593ea705b43809d7bb5dd20789249e71..a2feb5b53eb79d3016fe8c69c91218e316994097 100644 (file)
--- a/lib/gnutls_state.c
+++ b/lib/gnutls_state.c
@@ -484,12 +484,6 @@ gnutls_deinit (gnutls_session_t session)
 
 /* Returns the minimum prime bits that are acceptable.
  */
-int
-_gnutls_dh_get_allowed_prime_bits (gnutls_session_t session)
-{
-  return session->internals.dh_prime_bits;
-}
-
 int
 _gnutls_dh_set_peer_public (gnutls_session_t session, bigint_t public)
 {
@@ -1309,8 +1303,8 @@ gnutls_handshake_set_post_client_hello_function (gnutls_session_t session,
  *
  * This function can be used to disable certain (security) features in
  * TLS in order to maintain maximum compatibility with buggy
- * clients. It is equivalent to calling:
- * gnutls_record_disable_padding()
+ * clients. Because several trade-offs with security are enabled,
+ * if required they will be reported through the audit subsystem.
  *
  * Normally only servers that require maximum compatibility with
  * everything out there, need to call this function.
@@ -1318,7 +1312,7 @@ gnutls_handshake_set_post_client_hello_function (gnutls_session_t session,
 void
 gnutls_session_enable_compatibility_mode (gnutls_session_t session)
 {
-  gnutls_record_disable_padding (session);
+  ENABLE_COMPAT(&session->internals.priorities);
 }
 
 /**

diff --git a/lib/gnutls_state.h b/lib/gnutls_state.h
index a89e1817e699b9994b7f3a52625fe2a3267d94bc..cbb8a63b5119605d567d32c6530a88ce040b2e14 100644 (file)
--- a/lib/gnutls_state.h
+++ b/lib/gnutls_state.h
@@ -60,7 +60,12 @@ int _gnutls_dh_set_peer_public (gnutls_session_t session, bigint_t public);
 int _gnutls_dh_set_group (gnutls_session_t session, bigint_t gen,
                           bigint_t prime);
 
-int _gnutls_dh_get_allowed_prime_bits (gnutls_session_t session);
+static inline int
+_gnutls_dh_get_allowed_prime_bits (gnutls_session_t session)
+{
+  return session->internals.dh_prime_bits;
+}
+
 void _gnutls_handshake_internal_state_clear (gnutls_session_t);
 
 int _gnutls_rsa_export_set_pubkey (gnutls_session_t session,