From: Peter Wu <peter@lekensteyn.nl>
Date: Sun, 20 Oct 2019 17:10:31 +0000 (+0100)
Subject: resolved: fix connection failures with TLS 1.3 and GnuTLS
X-Git-Tag: v244-rc1~178
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=68805580209cfaa50b2400d1a2e6c66500001395;p=thirdparty%2Fsystemd.git

resolved: fix connection failures with TLS 1.3 and GnuTLS

Prefer TLS 1.3 before TLS 1.2 for DNS-over-TLS support, otherwise
servers compliant with RFC 8446 might end up agreeing TLS 1.2 plus a
downgrade signal which is not expected by GnuTLS clients. This manifests
in the following error:

    Failed to invoke gnutls_handshake: An illegal parameter has been received.

Fixes: #13528
Fixes: v242-962-g9c0624dcdb ("resolved: support TLS 1.3 when using GnuTLS for DNS-over-TLS")
---

diff --git a/src/resolve/resolved-dnstls-gnutls.c b/src/resolve/resolved-dnstls-gnutls.c
index 06d635fcc44..7ad96620732 100644
--- a/src/resolve/resolved-dnstls-gnutls.c
+++ b/src/resolve/resolved-dnstls-gnutls.c
@@ -10,7 +10,7 @@
 #include "resolved-dnstls.h"
 
 #if GNUTLS_VERSION_NUMBER >= 0x030600
-#define PRIORTY_STRING "NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3"
+#define PRIORTY_STRING "NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2"
 #else
 #define PRIORTY_STRING "NORMAL:-VERS-ALL:+VERS-TLS1.2"
 #endif