bug#9036: [PATCH] gnutls: Add option to set minimum acceptable Diffie-Hellman key size

[Lawrence Mitchell <wence@gmx.li>]

Lars Magne Ingebrigtsen wrote:
> Lawrence Mitchell <wence@gmx.li> writes:

>> With the recent gnutls changes I could no longer send mail with
>> STARTTLS since the smtp server I connect to only advertises a D-H
>> key with 512bits.  This is smaller than the default value gnutls
>> allows and so the connection would be aborted.  This patch adds
>> the ability to set the minimum acceptable size of key, so that I
>> can send email again!

> Thanks; I'll apply your patch.

> However, is there any way to make the gnutls library adjust the size
> downwards automatically if it's too big?

The handshake returns GNUTLS_E_DH_PRIME_UNACCEPTABLE if the
number of server prime bits is too low.  I don't know how to
query the size of the server prime.  Maybe
gnutls_dh_get_prime_bits?  I'm wary to automatically adjust
downwards.

A better error message (pointing at the existance of
gnutls-min-prime-bits) in the case of this failure mode would
probably be good though.  I'll try and cook up a patch in the
next few days.

Lawrence
-- 
Lawrence Mitchell <wence@gmx.li>