From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:38120) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QwXhy-0001Kl-HZ for qemu-devel@nongnu.org; Thu, 25 Aug 2011 07:02:52 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QwXhx-00068N-3v for qemu-devel@nongnu.org; Thu, 25 Aug 2011 07:02:50 -0400 Received: from mx1.redhat.com ([209.132.183.28]:20413) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QwXhw-00068J-T3 for qemu-devel@nongnu.org; Thu, 25 Aug 2011 07:02:49 -0400 Date: Thu, 25 Aug 2011 12:02:45 +0100 From: "Daniel P. Berrange" Message-ID: <20110825110245.GB22456@redhat.com> References: <51b5cbebc488fc126339651120e923934fe29928.1309816302.git.rprabhu@wnohang.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PATCH 1/3] Avoid the use of deprecated gnutls gnutls_*_set_priority functions. Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Hajnoczi Cc: Raghavendra D Prabhu , qemu-devel@nongnu.org, kvm@vger.kernel.org, Raghavendra D Prabhu On Thu, Aug 25, 2011 at 11:54:41AM +0100, Stefan Hajnoczi wrote: > On Mon, Jul 4, 2011 at 11:00 PM, Raghavendra D Prabhu > wrote: > > The gnutls_*_set_priority family of functions has been marked depreca= ted > > in 2.12.x. These functions have been superceded by > > gnutls_priority_set_direct(). > > > > Signed-off-by: Raghavendra D Prabhu > > --- > > =C2=A0ui/vnc-tls.c | =C2=A0 20 +------------------- > > =C2=A01 files changed, 1 insertions(+), 19 deletions(-) > > > > diff --git a/ui/vnc-tls.c b/ui/vnc-tls.c > > index dec626c..33a5d8c 100644 > > --- a/ui/vnc-tls.c > > +++ b/ui/vnc-tls.c > > @@ -286,10 +286,6 @@ int vnc_tls_validate_certificate(struct VncState= *vs) > > > > =C2=A0int vnc_tls_client_setup(struct VncState *vs, > > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0int needX509Creds) { > > - =C2=A0 =C2=A0static const int cert_type_priority[] =3D { GNUTLS_CRT= _X509, 0 }; > > - =C2=A0 =C2=A0static const int protocol_priority[]=3D { GNUTLS_TLS1_= 1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0 }; > > - =C2=A0 =C2=A0static const int kx_anon[] =3D {GNUTLS_KX_ANON_DH, 0}; > > - =C2=A0 =C2=A0static const int kx_x509[] =3D {GNUTLS_KX_DHE_DSS, GNU= TLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0}; > > > > =C2=A0 =C2=A0 VNC_DEBUG("Do TLS setup\n"); > > =C2=A0 =C2=A0 if (vnc_tls_initialize() < 0) { > > @@ -310,21 +306,7 @@ int vnc_tls_client_setup(struct VncState *vs, > > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 return -1; > > =C2=A0 =C2=A0 =C2=A0 =C2=A0 } > > > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0if (gnutls_kx_set_priority(vs->tls.sessi= on, needX509Creds ? kx_x509 : kx_anon) < 0) { > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0gnutls_deinit(vs->tls.sess= ion); > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0vs->tls.session =3D NULL; > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0vnc_client_error(vs); > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return -1; > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0} > > - > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0if (gnutls_certificate_type_set_priority= (vs->tls.session, cert_type_priority) < 0) { > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0gnutls_deinit(vs->tls.sess= ion); > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0vs->tls.session =3D NULL; > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0vnc_client_error(vs); > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return -1; > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0} > > - > > - =C2=A0 =C2=A0 =C2=A0 =C2=A0if (gnutls_protocol_set_priority(vs->tls= .session, protocol_priority) < 0) { > > + =C2=A0 =C2=A0 =C2=A0 =C2=A0if (gnutls_priority_set_direct(vs->tls.s= ession, needX509Creds ? "NORMAL" : "NORMAL:+ANON-DH", NULL) < 0) { > > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 gnutls_deinit(vs->tls.sessi= on); > > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 vs->tls.session =3D NULL; > > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 vnc_client_error(vs); > > -- > > 1.7.6 >=20 > Daniel, > This patch looks good to me but I don't know much about gnutls or > crypto in general. Would you be willing to review this? ACK, this approach is different from what I did in libvirt, but it matche= s the recommendations in the GNUTLS manual for setting priority, so I belie= ve it is good. Signed-off-by: Daniel P. Berrange Regards, Daniel --=20 |: http://berrange.com -o- http://www.flickr.com/photos/dberrange= / :| |: http://libvirt.org -o- http://virt-manager.or= g :| |: http://autobuild.org -o- http://search.cpan.org/~danberr= / :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vn= c :|