Hey

On Tue, Nov 1, 2011 at 11:20 PM, Daniel Stenberg <daniel_at_haxx.se> wrote:How
about something like this:

>
> From 2000de93adbf19c7bd6b3f6e8c6774**392139c643 Mon Sep 17 00:00:00 2001
> From: Daniel Stenberg <daniel_at_haxx.se>
> Date: Tue, 1 Nov 2011 23:17:24 +0100
> Subject: [PATCH] gtls_connect_step1: remove use of deprecated functions
>
> Use gnutls_priority_set_direct() instead of
> gnutls_protocol_set_priority()**.
>
> Remove the gnutls_certificate_type_set_**priority() use since x509 is the
> default certificate type anyway.
>
> Reported by: Vincent Torri
> ---
> lib/gtls.c | 13 +++----------
> 1 files changed, 3 insertions(+), 10 deletions(-)
>
> diff --git a/lib/gtls.c b/lib/gtls.c
> index c1e9cae..3ac6c56 100644
> --- a/lib/gtls.c
> +++ b/lib/gtls.c
> @@ -320,7 +320,6 @@ static CURLcode
> gtls_connect_step1(struct connectdata *conn,
> int sockindex)
> {
> - static const int cert_type_priority[] = { GNUTLS_CRT_X509, 0 };
> struct SessionHandle *data = conn->data;
> gnutls_session session;
> int rc;
> @@ -440,19 +439,13 @@ gtls_connect_step1(struct connectdata *conn,
> return CURLE_SSL_CONNECT_ERROR;
>
> if(data->set.ssl.version == CURL_SSLVERSION_SSLv3) {
> - static const int protocol_priority[] = { GNUTLS_SSL3, 0 };
> - gnutls_protocol_set_priority(**session, protocol_priority);
> + const char *err;
> + rc = gnutls_priority_set_direct(**session,
> "-VERS-TLS-ALL:+VERS-SSL3.0",
> + &err);
> if(rc != GNUTLS_E_SUCCESS)
> return CURLE_SSL_CONNECT_ERROR;
> }
>
> - /* Sets the priority on the certificate types supported by gnutls.
> Priority
> - is higher for types specified before others. After specifying the
> types
> - you want, you must append a 0. */
> - rc = gnutls_certificate_type_set_**priority(session,
> cert_type_priority);
> - if(rc != GNUTLS_E_SUCCESS)
> - return CURLE_SSL_CONNECT_ERROR;
> -
> if(data->set.str[STRING_CERT]) {
> if(gnutls_certificate_set_**x509_key_file(
> conn->ssl[sockindex].cred,
>

I took the latest snapshot and patched it with the above patch. No warning
at all.

I don't know if it is necessary, but shouldn't also a check on the gnuTLS
version be needed in configure.ac ? Maybe you already check a sufficiently
recent version, i don't really know

thank you

Vincent Torri
Received on 2011-11-02