Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings.

2 files changed, 8 insertions, 3 deletions

diff --git a/NEWS b/NEWS
index 91236eff75..8c8076a9f8 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,10 @@ See the end for copying conditions.
 
 * Version 2.12.3 (unreleased)
 
+* libgnutls: Restored HMAC-MD5 for compatibility. Although considered 
+weak, several sites require it for connection. It is enabled for
+"NORMAL" and "PERFORMANCE" priority strings.
+
 * libgnutls: depend on libdl.
 
 * libgnutls: gnutls_transport_set_global_errno() was deprecated.
diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index 2f35a84689..8f592070f2 100644
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -355,9 +355,10 @@ static const int sign_priority_secure256[] = {
   0
 };
 
-static const int mac_priority_performance[] = {
+static const int mac_priority_normal[] = {
   GNUTLS_MAC_SHA1,
   GNUTLS_MAC_SHA256,
+  GNUTLS_MAC_MD5,
   0
 };
 
@@ -573,7 +574,7 @@ gnutls_priority_init (gnutls_priority_t * priority_cache,
           _set_priority (&(*priority_cache)->cipher,
                          cipher_priority_performance);
           _set_priority (&(*priority_cache)->kx, kx_priority_performance);
-          _set_priority (&(*priority_cache)->mac, mac_priority_performance);
+          _set_priority (&(*priority_cache)->mac, mac_priority_normal);
           _set_priority (&(*priority_cache)->sign_algo,
                          sign_priority_default);
         }
@@ -581,7 +582,7 @@ gnutls_priority_init (gnutls_priority_t * priority_cache,
         {
           _set_priority (&(*priority_cache)->cipher, cipher_priority_normal);
           _set_priority (&(*priority_cache)->kx, kx_priority_secure);
-          _set_priority (&(*priority_cache)->mac, mac_priority_secure);
+          _set_priority (&(*priority_cache)->mac, mac_priority_normal);
           _set_priority (&(*priority_cache)->sign_algo,
                          sign_priority_default);
         }