github-repos/wget
1
0
Fork 0
mirror of https://github.com/mirror/wget.git synced 2026-08-22 19:03:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

added PFS to --secure-protocol

Browse Source
This commit is contained in:
Tim Ruehsen
2013-09-03 11:49:01 +02:00
committed by Giuseppe Scrivano
parent e6123ed645
commit e505664ef3
9 changed files with 43 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
doc/ChangeLog
View File

@@ -1,3 +1,8 @@
2013-09-04 Tim Ruehsen <tim.ruehsen@gmx.de>
* sample.wgetrc: added "secureprotocol" example
* wget.texi (HTTPS (SSL/TLS) Options): Document PFS.
2013-08-23 Tim Ruehsen <tim.ruehsen@gmx.de>
* sample.wgetrc: added "httpsonly" example

3
doc/sample.wgetrc
View File

@@ -126,3 +126,6 @@
# Turn on to prevent following non-HTTPS links when in recursive mode
#httpsonly = off
# Tune HTTPS security (auto, SSLv2, SSLv3, TLSv1, PFS)
#secureprotocol = auto

15
doc/wget.texi
View File

@@ -1595,16 +1595,21 @@ without SSL support, none of these options are available.
@cindex SSL protocol, choose
@item --secure-protocol=@var{protocol}
Choose the secure protocol to be used. Legal values are @samp{auto},
@samp{SSLv2}, @samp{SSLv3}, and @samp{TLSv1}. If @samp{auto} is used,
the SSL library is given the liberty of choosing the appropriate
@samp{SSLv2}, @samp{SSLv3}, @samp{TLSv1} and @samp{PFS}. If @samp{auto}
is used, the SSL library is given the liberty of choosing the appropriate
protocol automatically, which is achieved by sending an SSLv2 greeting
and announcing support for SSLv3 and TLSv1. This is the default.
Specifying @samp{SSLv2}, @samp{SSLv3}, or @samp{TLSv1} forces the use
of the corresponding protocol. This is useful when talking to old and
buggy SSL server implementations that make it hard for OpenSSL to
choose the correct protocol version. Fortunately, such servers are
quite rare.
buggy SSL server implementations that make it hard for the underlying
SSL library to choose the correct protocol version. Fortunately, such
servers are quite rare.
Specifying @samp{PFS} enforces the use of the so-called Perfect Forward
Security cipher suites. In short, PFS adds security by creating a one-time
key for each SSL connection. It has a bit more CPU impact on client and server.
We use known to be secure ciphers (e.g. no MD4) and the TLS protocol.
@item --https-only
When in recursive mode, only HTTPS links are followed.