Re: [Qemu-devel] [PATCH 3/3] vns/tls: don't use depricated gnutls functions

[Stefan Weil <weil@mail.berlios.de>]

[-- Attachment #1: Type: text/plain, Size: 3514 bytes --]

See inline comments below.

Am 07.09.2011 15:02, schrieb Gerd Hoffmann:
> Avoid using depricated gnutls functions with recent gnutls versions.

deprecated?

> Fixes build failure on Fedora 16. Keep the old way for compatibility
> with old installations such as RHEL-5 (gnutls 1.4.x).
>
> Based on a patch from Raghavendra D Prabhu <raghu.prabhu13@gmail.com>
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
> ui/vnc-tls.c | 62 
> ++++++++++++++++++++++++++++++++++++++++-----------------
> 1 files changed, 43 insertions(+), 19 deletions(-)
>
> diff --git a/ui/vnc-tls.c b/ui/vnc-tls.c
> index 2e2456e..276e127 100644
> --- a/ui/vnc-tls.c
> +++ b/ui/vnc-tls.c
> @@ -283,13 +283,51 @@ int vnc_tls_validate_certificate(struct VncState 
> *vs)
> return 0;
> }
>
> +#if defined(GNUTLS_VERSION_NUMBER) && \
> + GNUTLS_VERSION_NUMBER >= 0x020200 /* 2.2.0 */
> +
> +static int vnc_set_gnutls_priority(struct VncState *vs, int 
> needX509Creds)

Replace the first argument by gnutls_session_t /session/.
This simplifies the code.

> +{
> + const char *priority = needX509Creds ? "NORMAL" : "NORMAL:+ANON-DH";
> +
> + if (gnutls_priority_set_direct(vs->tls.session, priority, NULL) < 0) {

Even if this works, testing for != GNUTLS_E_SUCCESS would be
better because GNUTLS_E_SUCCESS is the return value for success
according to the manual.

The same applies to the other function calls below as well.

> + return -1;
> + }
> + return 0;
> +}
> +
> +#else
> +
> +static int vnc_set_gnutls_priority(struct VncState *vs, int x509)

Replace the first argument by gnutls_session_t /session/.


> +{
> + static const int cert_types[] = { GNUTLS_CRT_X509, 0 };
> + static const int protocols[] = {
> + GNUTLS_TLS1_1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0
> + };
> + static const int kx_anon[] = { GNUTLS_KX_ANON_DH, 0 };
> + static const int kx_x509[] = {
> + GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA,
> + GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0
> + };
> +
> + if (gnutls_kx_set_priority(vs->tls.session, x509 ? kx_x509 : 
> kx_anon) < 0) {
> + return -1;
> + }
> +
> + if (gnutls_certificate_type_set_priority(vs->tls.session, 
> cert_types) < 0) {
> + return -1;
> + }
> +
> + if (gnutls_protocol_set_priority(vs->tls.session, protocols) < 0) {
> + return -1;
> + }
> + return 0;
> +}
> +
> +#endif
>
> int vnc_tls_client_setup(struct VncState *vs,
> int needX509Creds) {
> - static const int cert_type_priority[] = { GNUTLS_CRT_X509, 0 };
> - static const int protocol_priority[]= { GNUTLS_TLS1_1, 
> GNUTLS_TLS1_0, GNUTLS_SSL3, 0 };
> - static const int kx_anon[] = {GNUTLS_KX_ANON_DH, 0};
> - static const int kx_x509[] = {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, 
> GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0};
>
> VNC_DEBUG("Do TLS setup\n");
> if (vnc_tls_initialize() < 0) {
> @@ -310,21 +348,7 @@ int vnc_tls_client_setup(struct VncState *vs,
> return -1;
> }
>
> - if (gnutls_kx_set_priority(vs->tls.session, needX509Creds ? kx_x509 
> : kx_anon) < 0) {
> - gnutls_deinit(vs->tls.session);
> - vs->tls.session = NULL;
> - vnc_client_error(vs);
> - return -1;
> - }
> -
> - if (gnutls_certificate_type_set_priority(vs->tls.session, 
> cert_type_priority) < 0) {
> - gnutls_deinit(vs->tls.session);
> - vs->tls.session = NULL;
> - vnc_client_error(vs);
> - return -1;
> - }
> -
> - if (gnutls_protocol_set_priority(vs->tls.session, protocol_priority) 
> < 0) {
> + if (vnc_set_gnutls_priority(vs, needX509Creds) < 0) {

Use vs->tls.session as first argument.

> gnutls_deinit(vs->tls.session);
> vs->tls.session = NULL;
> vnc_client_error(vs);


[-- Attachment #2: Type: text/html, Size: 5045 bytes --]