From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:39900) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SCsMu-0005BA-13 for qemu-devel@nongnu.org; Wed, 28 Mar 2012 08:53:09 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SCsMq-0007pU-GP for qemu-devel@nongnu.org; Wed, 28 Mar 2012 08:52:51 -0400 From: =?UTF-8?q?Andreas=20F=C3=A4rber?= Date: Wed, 28 Mar 2012 14:52:20 +0200 Message-Id: <1332939159-16434-18-git-send-email-afaerber@suse.de> In-Reply-To: <1332939159-16434-1-git-send-email-afaerber@suse.de> References: <1332939159-16434-1-git-send-email-afaerber@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PATCH stable-0.15 17/36] vns/tls: don't use depricated gnutls functions List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Anthony Liguori , kvm@suse.de, qemu-stable@nongnu.org, Bruce Rogers , Gerd Hoffmann , =?UTF-8?q?Andreas=20F=C3=A4rber?= From: Gerd Hoffmann Avoid using deprecated gnutls functions with recent gnutls versions. Fixes build failure on Fedora 16. Keep the old way for compatibility with old installations such as RHEL-5 (gnutls 1.4.x). Based on a patch from Raghavendra D Prabhu Signed-off-by: Gerd Hoffmann Signed-off-by: Anthony Liguori (cherry picked from commit f40d55081667a716312b9a8b6e13835c4074f56b) Signed-off-by: Bruce Rogers Signed-off-by: Andreas F=C3=A4rber --- ui/vnc-tls.c | 68 +++++++++++++++++++++++++++++++++++++++++-----------= ----- 1 files changed, 49 insertions(+), 19 deletions(-) diff --git a/ui/vnc-tls.c b/ui/vnc-tls.c index 31f1467..f5ed306 100644 --- a/ui/vnc-tls.c +++ b/ui/vnc-tls.c @@ -283,13 +283,57 @@ int vnc_tls_validate_certificate(struct VncState *v= s) return 0; } =20 +#if defined(GNUTLS_VERSION_NUMBER) && \ + GNUTLS_VERSION_NUMBER >=3D 0x020200 /* 2.2.0 */ + +static int vnc_set_gnutls_priority(gnutls_session_t s, int x509) +{ + const char *priority =3D x509 ? "NORMAL" : "NORMAL:+ANON-DH"; + int rc; + + rc =3D gnutls_priority_set_direct(s, priority, NULL); + if (rc !=3D GNUTLS_E_SUCCESS) { + return -1; + } + return 0; +} + +#else + +static int vnc_set_gnutls_priority(gnutls_session_t s, int x509) +{ + static const int cert_types[] =3D { GNUTLS_CRT_X509, 0 }; + static const int protocols[] =3D { + GNUTLS_TLS1_1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0 + }; + static const int kx_anon[] =3D { GNUTLS_KX_ANON_DH, 0 }; + static const int kx_x509[] =3D { + GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, + GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0 + }; + int rc; + + rc =3D gnutls_kx_set_priority(s, x509 ? kx_x509 : kx_anon); + if (rc !=3D GNUTLS_E_SUCCESS) { + return -1; + } + + rc =3D gnutls_certificate_type_set_priority(s, cert_types); + if (rc !=3D GNUTLS_E_SUCCESS) { + return -1; + } + + rc =3D gnutls_protocol_set_priority(s, protocols); + if (rc !=3D GNUTLS_E_SUCCESS) { + return -1; + } + return 0; +} + +#endif =20 int vnc_tls_client_setup(struct VncState *vs, int needX509Creds) { - static const int cert_type_priority[] =3D { GNUTLS_CRT_X509, 0 }; - static const int protocol_priority[]=3D { GNUTLS_TLS1_1, GNUTLS_TLS1= _0, GNUTLS_SSL3, 0 }; - static const int kx_anon[] =3D {GNUTLS_KX_ANON_DH, 0}; - static const int kx_x509[] =3D {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, GN= UTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0}; =20 VNC_DEBUG("Do TLS setup\n"); if (vnc_tls_initialize() < 0) { @@ -310,21 +354,7 @@ int vnc_tls_client_setup(struct VncState *vs, return -1; } =20 - if (gnutls_kx_set_priority(vs->tls.session, needX509Creds ? kx_x= 509 : kx_anon) < 0) { - gnutls_deinit(vs->tls.session); - vs->tls.session =3D NULL; - vnc_client_error(vs); - return -1; - } - - if (gnutls_certificate_type_set_priority(vs->tls.session, cert_t= ype_priority) < 0) { - gnutls_deinit(vs->tls.session); - vs->tls.session =3D NULL; - vnc_client_error(vs); - return -1; - } - - if (gnutls_protocol_set_priority(vs->tls.session, protocol_prior= ity) < 0) { + if (vnc_set_gnutls_priority(vs->tls.session, needX509Creds) < 0)= { gnutls_deinit(vs->tls.session); vs->tls.session =3D NULL; vnc_client_error(vs); --=20 1.7.7