mirror of
https://gitlab.gnome.org/GNOME/glib.git
synced 2024-12-25 15:06:14 +01:00
GTlsClientConnection: loosen the semantics of "use-ssl3"
If SSL 3.0 has been disabled (at the host, application, or library level), then the "use-ssl3" property becomes a "fail-immediately" property. Despite the name, the point of the property wasn't really specifically to use SSL 3.0; it was to allow fallback when talking to broken servers that do SSL/TLS negotiation incorrectly and break when they see unexpectedly-high version numbers. So if we can't fall back to SSL 3.0, then the "use-ssl3" property should fall back to TLS 1.0 instead (since there are hosts that will reject a TLS 1.2 handshake, but accept a TLS 1.0 one). glib-networking is being updated to implement that behavior, so update the documentation here. https://bugzilla.gnome.org/show_bug.cgi?id=738633
This commit is contained in:
parent
f6bbd19beb
commit
7f5c862e16
@ -103,18 +103,23 @@ g_tls_client_connection_default_init (GTlsClientConnectionInterface *iface)
|
||||
/**
|
||||
* GTlsClientConnection:use-ssl3:
|
||||
*
|
||||
* If %TRUE, tells the connection to use SSL 3.0 rather than trying
|
||||
* to negotiate the best version of TLS or SSL to use. This can be
|
||||
* used when talking to servers that don't implement version
|
||||
* negotiation correctly and therefore refuse to handshake at all with
|
||||
* a "modern" TLS handshake.
|
||||
* If %TRUE, tells the connection to use a fallback version of TLS
|
||||
* or SSL, rather than trying to negotiate the best version of TLS
|
||||
* to use. This can be used when talking to servers that don't
|
||||
* implement version negotiation correctly and therefore refuse to
|
||||
* handshake at all with a "modern" TLS handshake.
|
||||
*
|
||||
* Despite the property name, the fallback version is not
|
||||
* necessarily SSL 3.0; if SSL 3.0 has been disabled, the
|
||||
* #GTlsClientConnection will use the next highest available version
|
||||
* (normally TLS 1.0) as the fallback version.
|
||||
*
|
||||
* Since: 2.28
|
||||
*/
|
||||
g_object_interface_install_property (iface,
|
||||
g_param_spec_boolean ("use-ssl3",
|
||||
P_("Use SSL3"),
|
||||
P_("Use SSL 3.0 rather than trying to use TLS 1.x"),
|
||||
P_("Use fallback"),
|
||||
P_("Use fallback version of SSL/TLS rather than most recent version"),
|
||||
FALSE,
|
||||
G_PARAM_READWRITE |
|
||||
G_PARAM_CONSTRUCT |
|
||||
|
Loading…
Reference in New Issue
Block a user