Do not explicitly disable SSLv3 if GnuTLS does it already.

[claws.git] / src / common / ssl.c

diff --git a/src/common/ssl.c b/src/common/ssl.c
index f6122992f04252d3f8445d5457fcc7ff640cbd01..e25a42301fb73752a1d71b1cd7b6f1108ab31ce8 100644 (file)
--- a/src/common/ssl.c
+++ b/src/common/ssl.c
@@ -83,8 +83,10 @@ static int gnutls_cert_cb(gnutls_session_t session,
        hookdata.is_smtp = sockinfo->is_smtp;
        hooks_invoke(SSLCERT_GET_CLIENT_CERT_HOOKLIST, &hookdata);      
 
-       if (hookdata.cert_path == NULL)
+       if (hookdata.cert_path == NULL) {
+               g_free(hookdata.password);
                return 0;
+       }
 
        sockinfo->client_crt = ssl_certificate_get_x509_from_pem_file(hookdata.cert_path);
        sockinfo->client_key = ssl_certificate_get_pkey_from_pem_file(hookdata.cert_path);
@@ -106,13 +108,16 @@ static int gnutls_cert_cb(gnutls_session_t session,
                st->cert.x509 = &(sockinfo->client_crt);
                st->key.x509 = sockinfo->client_key;
                st->deinit_all = 0;
+               g_free(hookdata.password);
                return 0;
        }
+       g_free(hookdata.password);
        return 0;
 }
 
 const gchar *claws_ssl_get_cert_file(void)
 {
+#ifndef G_OS_WIN32
        const char *cert_files[]={
                "/etc/pki/tls/certs/ca-bundle.crt",
                "/etc/certs/ca-bundle.crt",
@@ -126,9 +131,12 @@ const gchar *claws_ssl_get_cert_file(void)
                "/usr/lib/ssl/cert.pem",
                NULL};
        int i;
-       
+#endif
+
+       /* We honor this environment variable on all platforms. */
        if (g_getenv("SSL_CERT_FILE"))
                return g_getenv("SSL_CERT_FILE");
+
 #ifndef G_OS_WIN32
        for (i = 0; cert_files[i]; i++) {
                if (is_file_exist(cert_files[i]))
@@ -136,7 +144,7 @@ const gchar *claws_ssl_get_cert_file(void)
        }
        return NULL;
 #else
-       return get_cert_file();
+       return w32_get_cert_file();
 #endif
 }
 
@@ -281,7 +289,7 @@ gnutls_x509_crt_t *ssl_get_certificate_chain(gnutls_session_t session, gint *lis
                        gnutls_x509_crt_init(&certs[i]);
                        r = gnutls_x509_crt_import(certs[i], &raw_cert_list[i], GNUTLS_X509_FMT_DER);
                        if (r < 0) {
-                               g_warning("cert get failure: %d %s\n", r, gnutls_strerror(r));
+                               g_warning("cert get failure: %d %s", r, gnutls_strerror(r));
 
                                result = FALSE;
                                i--;
@@ -322,9 +330,11 @@ gboolean ssl_init_socket(SockInfo *sockinfo)
                debug_print("Setting GnuTLS priority to %s, status = %d\n",
                            sockinfo->gnutls_priority, r);
        }
+#ifdef GNUTLS_VERSION_NUMBER < 0x030400
        else {
-               gnutls_priority_set_direct(session, "NORMAL", NULL);
+               gnutls_priority_set_direct(session, "NORMAL:-VERS-SSL3.0", NULL);
        }
+#endif
        gnutls_record_disable_padding(session);
 
        gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
@@ -332,7 +342,7 @@ gboolean ssl_init_socket(SockInfo *sockinfo)
        if (claws_ssl_get_cert_file()) {
                r = gnutls_certificate_set_x509_trust_file(xcred, claws_ssl_get_cert_file(),  GNUTLS_X509_FMT_PEM);
                if (r < 0)
-                       g_warning("Can't read SSL_CERT_FILE %s: %s\n",
+                       g_warning("Can't read SSL_CERT_FILE '%s': %s",
                                claws_ssl_get_cert_file(), 
                                gnutls_strerror(r));
        } else {