From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Mon, 17 Sep 2012 17:45:18 +0000 (+0200)
Subject: gnutls_session_enable_compatibility_mode() is equivalent to %COMPAT priority string.
X-Git-Tag: gnutls_3_1_2~51
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=416655970fdf466289d8db1ef9387388e4f1e0dc;p=thirdparty%2Fgnutls.git

gnutls_session_enable_compatibility_mode() is equivalent to %COMPAT priority string.
---

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index d621e138ef..eb19b6c5a6 100644
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -595,6 +595,11 @@ struct gnutls_priority_st
   unsigned int additional_verify_flags;
 };
 
+#define ENABLE_COMPAT(x) \
+              (x)->no_padding = 1; \
+              (x)->allow_large_records = 1; \
+              (x)->allow_key_usage_violation = 1; \
+              (x)->allow_weak_keys = 1
 
 /* DH and RSA parameters types.
  */
diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index 704bc0a588..9c0eed95b0 100644
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -978,10 +978,7 @@ gnutls_priority_init (gnutls_priority_t * priority_cache,
         {
           if (strcasecmp (&broken_list[i][1], "COMPAT") == 0)
             {
-              (*priority_cache)->no_padding = 1;
-              (*priority_cache)->allow_large_records = 1;
-              (*priority_cache)->allow_key_usage_violation = 1;
-              (*priority_cache)->allow_weak_keys = 1;
+              ENABLE_COMPAT((*priority_cache));
             }
           else if (strcasecmp (&broken_list[i][1], "NO_EXTENSIONS") == 0)
             {
diff --git a/lib/gnutls_state.c b/lib/gnutls_state.c
index c9c09cef59..a2feb5b53e 100644
--- a/lib/gnutls_state.c
+++ b/lib/gnutls_state.c
@@ -484,12 +484,6 @@ gnutls_deinit (gnutls_session_t session)
 
 /* Returns the minimum prime bits that are acceptable.
  */
-int
-_gnutls_dh_get_allowed_prime_bits (gnutls_session_t session)
-{
-  return session->internals.dh_prime_bits;
-}
-
 int
 _gnutls_dh_set_peer_public (gnutls_session_t session, bigint_t public)
 {
@@ -1309,8 +1303,8 @@ gnutls_handshake_set_post_client_hello_function (gnutls_session_t session,
  *
  * This function can be used to disable certain (security) features in
  * TLS in order to maintain maximum compatibility with buggy
- * clients. It is equivalent to calling:
- * gnutls_record_disable_padding()
+ * clients. Because several trade-offs with security are enabled,
+ * if required they will be reported through the audit subsystem.
  *
  * Normally only servers that require maximum compatibility with
  * everything out there, need to call this function.
@@ -1318,7 +1312,7 @@ gnutls_handshake_set_post_client_hello_function (gnutls_session_t session,
 void
 gnutls_session_enable_compatibility_mode (gnutls_session_t session)
 {
-  gnutls_record_disable_padding (session);
+  ENABLE_COMPAT(&session->internals.priorities);
 }
 
 /**
diff --git a/lib/gnutls_state.h b/lib/gnutls_state.h
index a89e1817e6..cbb8a63b51 100644
--- a/lib/gnutls_state.h
+++ b/lib/gnutls_state.h
@@ -60,7 +60,12 @@ int _gnutls_dh_set_peer_public (gnutls_session_t session, bigint_t public);
 int _gnutls_dh_set_group (gnutls_session_t session, bigint_t gen,
                           bigint_t prime);
 
-int _gnutls_dh_get_allowed_prime_bits (gnutls_session_t session);
+static inline int
+_gnutls_dh_get_allowed_prime_bits (gnutls_session_t session)
+{
+  return session->internals.dh_prime_bits;
+}
+
 void _gnutls_handshake_internal_state_clear (gnutls_session_t);
 
 int _gnutls_rsa_export_set_pubkey (gnutls_session_t session,