From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Robert Pluim Newsgroups: gmane.emacs.devel Subject: Deprecate TLS1.0 support in emacs Date: Wed, 12 Jul 2017 15:03:39 +0200 Organization: not if I can help it Message-ID: <87o9sp7qok.fsf@gmail.com> Reply-To: emacs-devel@gnu.org NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" X-Trace: blaine.gmane.org 1499866417 30484 195.159.176.226 (12 Jul 2017 13:33:37 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Wed, 12 Jul 2017 13:33:37 +0000 (UTC) User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.0.50 (gnu/linux) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Wed Jul 12 15:33:25 2017 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dVHlY-00075j-Fr for ged-emacs-devel@m.gmane.org; Wed, 12 Jul 2017 15:33:20 +0200 Original-Received: from localhost ([::1]:53019 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dVHld-0004Fc-Td for ged-emacs-devel@m.gmane.org; Wed, 12 Jul 2017 09:33:25 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:47282) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dVHJn-00049t-Ed for emacs-devel@gnu.org; Wed, 12 Jul 2017 09:04:40 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dVHJi-0005Fn-NC for emacs-devel@gnu.org; Wed, 12 Jul 2017 09:04:39 -0400 Original-Received: from [195.159.176.226] (port=40165 helo=blaine.gmane.org) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dVHJi-0005El-GY for emacs-devel@gnu.org; Wed, 12 Jul 2017 09:04:34 -0400 Original-Received: from list by blaine.gmane.org with local (Exim 4.84_2) (envelope-from ) id 1dVHJO-00078U-G4 for emacs-devel@gnu.org; Wed, 12 Jul 2017 15:04:14 +0200 X-Injected-Via-Gmane: http://gmane.org/ Mail-Followup-To: emacs-devel@gnu.org Original-Lines: 81 Original-X-Complaints-To: usenet@blaine.gmane.org Mail-Copies-To: never Cancel-Lock: sha1:w+xPL5sPy7cQpQ2S6M/4ILsSWIo= X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 195.159.176.226 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.org gmane.emacs.devel:216530 Archived-At: --=-=-= Content-Type: text/plain Hi, whilst investigating another bug, I noticed that https://lists.gnu.org/ is still using TLS1.0, which is seriously deprecated. I propose the following patch to make emacs not use TLS1.0 anymore unless explicitly requested (and someone should update the settings on lists.gnu.org). Perhaps this warrants a NEWS entry as well, let me know. Regards Robert --=-=-= Content-Type: text/x-diff Content-Disposition: inline; filename=0001-Remove-TLS1.0-from-default-gnutls-connection-paramet.patch >From e0526d6ac7a2622a1b8781be4825fbef985a5ed3 Mon Sep 17 00:00:00 2001 From: Robert Pluim Date: Wed, 12 Jul 2017 14:59:35 +0200 Subject: [PATCH] Remove TLS1.0 from default gnutls connection parameters * lisp/net/gnutls.el (gnutls-boot-parameters): Remove TLS1.0 from default parameters. * src/gnutls.c (Fgnutls_boot): Likewise. --- lisp/net/gnutls.el | 4 ++-- src/gnutls.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lisp/net/gnutls.el b/lisp/net/gnutls.el index 5db87329c3..3386dc5efc 100644 --- a/lisp/net/gnutls.el +++ b/lisp/net/gnutls.el @@ -264,11 +264,11 @@ gnutls-log-level (priority-string (or priority-string (cond ((eq type 'gnutls-anon) - "NORMAL:+ANON-DH:!ARCFOUR-128") + "NORMAL:+ANON-DH:!ARCFOUR-128:-VERS-TLS1.0") ((eq type 'gnutls-x509pki) (if gnutls-algorithm-priority (upcase gnutls-algorithm-priority) - "NORMAL"))))) + "NORMAL:-VERS-TLS1.0"))))) (verify-error (or verify-error ;; this uses the value of `gnutls-verify-error' (cond diff --git a/src/gnutls.c b/src/gnutls.c index 2078ad88f2..c3d7f54b73 100644 --- a/src/gnutls.c +++ b/src/gnutls.c @@ -1333,7 +1333,7 @@ PROPLIST is a property list with the following keys: :hostname is a string naming the remote host. -:priority is a GnuTLS priority string, defaults to "NORMAL". +:priority is a GnuTLS priority string, defaults to "NORMAL:-VERS-TLS1.0". :trustfiles is a list of PEM-encoded trust files for `gnutls-x509pki'. @@ -1389,7 +1389,7 @@ one trustfile (usually a CA bundle). */) gnutls_certificate_credentials_t x509_cred = NULL; gnutls_anon_client_credentials_t anon_cred = NULL; Lisp_Object global_init; - char const *priority_string_ptr = "NORMAL"; /* default priority string. */ + char const *priority_string_ptr = "NORMAL:-VERS-TLS1.0"; /* default priority string. */ char *c_hostname; /* Placeholders for the property list elements. */ -- 2.13.0.rc0 --=-=-=--