The session ticket and OCSP certificate status extensions are enabled by default.

In client side gnutls_init() enables the session ticket and
OCSP certificate status request extensions by default. The flag
GNUTLS_NO_EXTENSIONS can be used to prevent that.

diff --git a/NEWS b/NEWS
index f22d2ca5699bc1653a9c156d815639f26ea52c73..9854b5525c5051e11c342827cabd5adf3b80c453 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,10 @@ Reported by danblack at http://savannah.gnu.org/support/?108146
 ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP
 response corresponds to the given certificate.
 
+** libgnutls: In client side gnutls_init() enables the session ticket and
+OCSP certificate status request extensions by default. The flag
+GNUTLS_NO_EXTENSIONS can be used to prevent that.
+
 ** libdane: Added. It is a library to provide DANE with DNSSEC certificate
 verification.
 

diff --git a/doc/examples/ex-client-resume.c b/doc/examples/ex-client-resume.c
index a9417ce9d046bfe91e006c596e64d5a4f1b6771b..0fe2a8860eaea8d4b7d3ca266a9970420da56baa 100644 (file)
--- a/doc/examples/ex-client-resume.c
+++ b/doc/examples/ex-client-resume.c
@@ -47,9 +47,6 @@ main (void)
       sd = tcp_connect ();
 
       gnutls_init (&session, GNUTLS_CLIENT);
-      /* enable useful extensions */
-      gnutls_session_ticket_enable_client(session);
-      gnutls_ocsp_status_request_enable_client(session, NULL, 0, NULL);
 
       gnutls_priority_set_direct (session, "PERFORMANCE:!ARCFOUR-128", NULL);
 

diff --git a/doc/examples/ex-client-x509.c b/doc/examples/ex-client-x509.c
index ce55b2080540b9ce83504d3bcd9897a8949de783..6939ba36a664515ebb728ae02832545e3838092c 100644 (file)
--- a/doc/examples/ex-client-x509.c
+++ b/doc/examples/ex-client-x509.c
@@ -55,10 +55,6 @@ int main (void)
   
   gnutls_session_set_ptr (session, (void *) "my_host_name");
 
-  /* enable useful extensions */
-  gnutls_session_ticket_enable_client(session);
-  gnutls_ocsp_status_request_enable_client(session, NULL, 0, NULL);
-
   gnutls_server_name_set (session, GNUTLS_NAME_DNS, "my_host_name", 
                           strlen("my_host_name"));
 

diff --git a/lib/gnutls_state.c b/lib/gnutls_state.c
index 5793c5c0294d0ce0390ddbf8fb53f9b351462f8d..a9a1ea036d379ef5bda2ac42a2194b74adeb63ea 100644 (file)
--- a/lib/gnutls_state.c
+++ b/lib/gnutls_state.c
@@ -295,6 +295,11 @@ _gnutls_handshake_internal_state_clear (gnutls_session_t session)
  * also available. The latter flag will enable a non-blocking
  * operation of the DTLS timers. 
  *
+ * Note that since version 3.1.2 this function enables some common
+ * TLS extensions such as session tickets and OCSP certificate status
+ * request in client side by default. To prevent that use the %GNUTLS_NO_EXTENSIONS
+ * flag.
+ *
  * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
  **/
 int
@@ -402,6 +407,13 @@ gnutls_init (gnutls_session_t * session, unsigned int flags)
   else
     (*session)->internals.dtls.blocking = 1;
 
+  /* Enable useful extensions */
+  if ((flags & GNUTLS_CLIENT) && !(flags & GNUTLS_NO_EXTENSIONS))
+    {
+      gnutls_session_ticket_enable_client(*session);
+      gnutls_ocsp_status_request_enable_client(*session, NULL, 0, NULL);
+    }
+
   return 0;
 }
 

diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index 51e594e65c7ae3a831b5ae791f3c4c29c3c6df7f..ec553a03f36a119c078aead528bde69477c972e9 100644 (file)
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -295,12 +295,14 @@ extern "C"
    * @GNUTLS_CLIENT: Connection end is a client.
    * @GNUTLS_DATAGRAM: Connection is datagram oriented (DTLS).
    * @GNUTLS_NONBLOCK: Connection should not block (DTLS).
+   * @GNUTLS_NO_EXTENSIONS: Do not enable any TLS extensions by default.
    *
    */
 #define GNUTLS_SERVER 1
 #define GNUTLS_CLIENT (1<<1)
 #define GNUTLS_DATAGRAM (1<<2)
 #define GNUTLS_NONBLOCK (1<<3)
+#define GNUTLS_NO_EXTENSIONS (1<<4)
 
 /**
  * gnutls_alert_level_t:

diff --git a/src/cli-args.c b/src/cli-args.c
index 585591836ff309e79e769ffd01ddd972059cb327..819ac38d668d07e578b78fedc64f4a0841ca26db 100644 (file)
--- a/src/cli-args.c
+++ b/src/cli-args.c
@@ -2,7 +2,7 @@
  *  
  *  DO NOT EDIT THIS FILE   (cli-args.c)
  *  
- *  It has been AutoGen-ed  October  7, 2012 at 12:14:56 AM by AutoGen 5.16
+ *  It has been AutoGen-ed  October  7, 2012 at 01:02:46 PM by AutoGen 5.16
  *  From the definitions    cli-args.def
  *  and the template file   options
  *

diff --git a/src/cli-args.h b/src/cli-args.h
index 55d213812fb3b77530ff983165f4ff5166c7d0ee..f2ad811dfd2d80a64fe22caad5afe1c5ab025ed4 100644 (file)
--- a/src/cli-args.h
+++ b/src/cli-args.h
@@ -2,7 +2,7 @@
  *  
  *  DO NOT EDIT THIS FILE   (cli-args.h)
  *  
- *  It has been AutoGen-ed  October  7, 2012 at 12:14:56 AM by AutoGen 5.16
+ *  It has been AutoGen-ed  October  7, 2012 at 01:02:46 PM by AutoGen 5.16
  *  From the definitions    cli-args.def
  *  and the template file   options
  *

diff --git a/src/tls_test.c b/src/tls_test.c
index 67ff904d2f4009f9bbffbde85a6fc039c7cdd5fa..f4f61b1a6fcc310b771dba29222629b0630402fa 100644 (file)
--- a/src/tls_test.c
+++ b/src/tls_test.c
@@ -275,7 +275,7 @@ main (int argc, char **argv)
               continue;
             }
         }
-      ERR (err, "connect") gnutls_init (&state, GNUTLS_CLIENT);
+      ERR (err, "connect") gnutls_init (&state, GNUTLS_CLIENT|GNUTLS_NO_EXTENSIONS);
       gnutls_transport_set_ptr (state, (gnutls_transport_ptr_t)
                                 gl_fd_to_handle (sd));
 

diff --git a/tests/resume-dtls.c b/tests/resume-dtls.c
index 03f606ce18652e03af41747da09385c563c2afd2..3e56645a7e30f4c8890ede3b3d0ae35ed45ff9ce 100644 (file)
--- a/tests/resume-dtls.c
+++ b/tests/resume-dtls.c
@@ -122,7 +122,7 @@ client (struct params_res *params)
 
       /* Initialize TLS session
        */
-      gnutls_init (&session, GNUTLS_CLIENT|GNUTLS_DATAGRAM);
+      gnutls_init (&session, GNUTLS_CLIENT|GNUTLS_DATAGRAM|GNUTLS_NO_EXTENSIONS);
 
       /* Use default priorities */
       gnutls_priority_set_direct (session, "NONE:+VERS-DTLS1.0:+CIPHER-ALL:+MAC-ALL:+SIGN-ALL:+COMP-ALL:+ANON-DH", NULL);

diff --git a/tests/resume.c b/tests/resume.c
index 6b63332385f4082c30e81336c165b784683ed028..b6b47d7c47b44f96fcdc29f47e91c249895706d0 100644 (file)
--- a/tests/resume.c
+++ b/tests/resume.c
@@ -113,7 +113,7 @@ client (struct params_res *params)
 
       /* Initialize TLS session
        */
-      gnutls_init (&session, GNUTLS_CLIENT);
+      gnutls_init (&session, GNUTLS_CLIENT|GNUTLS_NO_EXTENSIONS);
 
       /* Use default priorities */
       gnutls_priority_set_direct (session, "NONE:+VERS-TLS-ALL:+CIPHER-ALL:+MAC-ALL:+SIGN-ALL:+COMP-ALL:+ANON-DH", NULL);