GNOME Bugzilla – Bug 615535
GNUTLS_E_DH_PRIME_UNACCEPTABLE, etc
Last modified: 2010-05-22 21:56:49 UTC
Trying to connect to https://www.alecu.org/ causes an infinite loop. Trying to connect to *any* https site with the latest unstable gnutls does the same thing. Multiple levels of bugs here... 1. We need to be better about when we do and don't retry messages after an I/O failure, so we don't get into infinite loops. Most likely, we want to only retry if the first attempt was on a SoupConnection that had previously been successfully used. (If we get this wrong it's going to bring back "Connection terminated unexpectedly" though.) 2. The "Unable to handshake" error in soup-gnutls.c should be SOUP_SSL_ERROR, not G_IO_CHANNEL_ERROR. 3. Apparently gnutls requires that the server use a certain minimum key size, and refuses to talk if it's smaller than that. Apparently some stupid antiquated servers use smaller key sizes than that. http://lists.gnupg.org/pipermail/gnutls-dev/2003-September/000518.html suggests "gnutls_dh_set_prime_bits (session, 512)". (The default value has not changed in gnutls master though, so this doesn't seem to be the cause of "everything fails with gnutls unstable".)
all 3 fixed in git