Skip to content

Commit

Permalink
tls-gnutls.c: Use system crypto policy if available
Browse files Browse the repository at this point in the history
Some Linux systems provide a way how to control cryptography on system
or service level via cryptographic policies. OpenSSL implementation
reflects system changes to some degree, however GnuTLS implementation
does not take system policy into account.

GnuTLS supports fallback mechanism, so we can fallback to NORMAL if
@System is not defined on the system.

Fortunately, the current GnuTLS implementation allows overrides via
priority strings (so no "this cipher/hash is disabled" if we enabled
them in our application by priority string), so allowing to honor system
policy can save us work if someone wants to disable a specific cipher,
so we don't have to implement it in libcups.
  • Loading branch information
zdohnal committed Dec 4, 2024
1 parent 73bd9ce commit d3474cc
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion cups/tls-gnutls.c
Original file line number Diff line number Diff line change
Expand Up @@ -1813,7 +1813,7 @@ _httpTLSStart(http_t *http) // I - Connection to server
return (false);
}

cupsCopyString(priority_string, "NORMAL", sizeof(priority_string));
cupsCopyString(priority_string, "@SYSTEM,NORMAL", sizeof(priority_string));

if (tls_max_version < _HTTP_TLS_MAX)
{
Expand Down

0 comments on commit d3474cc

Please sign in to comment.