From: Sjoer van der Ploeg <sfjuocekr@gmail.com>
To: xen-devel@lists.xenproject.org
Cc: sfjuocekr@gmail.com
Subject: [PATCH] Fixed building with newer GNUTLS versions.
Date: Thu, 31 Mar 2016 22:58:19 +0200 [thread overview]
Message-ID: <1459457899-24651-1-git-send-email-sfjuocekr@gmail.com> (raw)
Signed-off-by: Sjoer van der Ploeg <sfjuocekr@gmail.com>
---
vnc.c | 71 +++++++++++++++++++++++++++++++++++++++++++++----------------------
1 file changed, 48 insertions(+), 23 deletions(-)
diff --git a/vnc.c b/vnc.c
index 573af3b..61d1555 100644
--- a/vnc.c
+++ b/vnc.c
@@ -1925,9 +1925,9 @@ static int vnc_tls_initialize(void)
return 1;
}
-static gnutls_anon_server_credentials vnc_tls_initialize_anon_cred(void)
+static gnutls_anon_server_credentials_t vnc_tls_initialize_anon_cred(void)
{
- gnutls_anon_server_credentials anon_cred;
+ gnutls_anon_server_credentials_t anon_cred;
int ret;
if ((ret = gnutls_anon_allocate_server_credentials(&anon_cred)) < 0) {
@@ -2151,13 +2151,52 @@ static void vnc_handshake_io(void *opaque) {
(vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC || \
(vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN)
+#if defined(GNUTLS_VERSION_NUMBER) && \
+ GNUTLS_VERSION_NUMBER >= 0x020200 /* 2.2.0 */
+static int vnc_set_gnutls_priority(gnutls_session_t s, int x509)
+{
+ const char *priority = x509 ? "NORMAL" : "NORMAL:+ANON-DH";
+ int rc;
-static int vnc_start_tls(struct VncState *vs) {
- static const int cert_type_priority[] = { GNUTLS_CRT_X509, 0 };
- static const int protocol_priority[]= { GNUTLS_TLS1_1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0 };
- static const int kx_anon[] = {GNUTLS_KX_ANON_DH, 0};
- static const int kx_x509[] = {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0};
+ rc = gnutls_priority_set_direct(s, priority, NULL);
+ if (rc != GNUTLS_E_SUCCESS) {
+ return -1;
+ }
+ return 0;
+}
+#else
+static int vnc_set_gnutls_priority(gnutls_session_t s, int x509)
+{
+ static const int cert_types[] = { GNUTLS_CRT_X509, 0 };
+ static const int protocols[] = {
+ GNUTLS_TLS1_1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0
+ };
+ static const int kx_anon[] = { GNUTLS_KX_ANON_DH, 0 };
+ static const int kx_x509[] = {
+ GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA,
+ GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0
+ };
+ int rc;
+
+ rc = gnutls_kx_set_priority(s, x509 ? kx_x509 : kx_anon);
+ if (rc != GNUTLS_E_SUCCESS) {
+ return -1;
+ }
+
+ rc = gnutls_certificate_type_set_priority(s, cert_types);
+ if (rc != GNUTLS_E_SUCCESS) {
+ return -1;
+ }
+ rc = gnutls_protocol_set_priority(s, protocols);
+ if (rc != GNUTLS_E_SUCCESS) {
+ return -1;
+ }
+ return 0;
+}
+#endif
+
+static int vnc_start_tls(struct VncState *vs) {
VNC_DEBUG("Do TLS setup\n");
if (vnc_tls_initialize() < 0) {
VNC_DEBUG("Failed to init TLS\n");
@@ -2177,21 +2216,7 @@ static int vnc_start_tls(struct VncState *vs) {
return -1;
}
- if (gnutls_kx_set_priority(vs->tls_session, NEED_X509_AUTH(vs) ? kx_x509 : kx_anon) < 0) {
- gnutls_deinit(vs->tls_session);
- vs->tls_session = NULL;
- vnc_client_error(vs);
- return -1;
- }
-
- if (gnutls_certificate_type_set_priority(vs->tls_session, cert_type_priority) < 0) {
- gnutls_deinit(vs->tls_session);
- vs->tls_session = NULL;
- vnc_client_error(vs);
- return -1;
- }
-
- if (gnutls_protocol_set_priority(vs->tls_session, protocol_priority) < 0) {
+ if (vnc_set_gnutls_priority(vs->tls_session, !!NEED_X509_AUTH(vs)) < 0) {
gnutls_deinit(vs->tls_session);
vs->tls_session = NULL;
vnc_client_error(vs);
@@ -2219,7 +2244,7 @@ static int vnc_start_tls(struct VncState *vs) {
}
} else {
- gnutls_anon_server_credentials anon_cred = vnc_tls_initialize_anon_cred();
+ gnutls_anon_server_credentials_t anon_cred = vnc_tls_initialize_anon_cred();
if (!anon_cred) {
gnutls_deinit(vs->tls_session);
vs->tls_session = NULL;
--
2.8.0.rc3
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
next reply other threads:[~2016-03-31 20:58 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-31 20:58 Sjoer van der Ploeg [this message]
2016-04-01 13:51 ` QEMU-TRAD Re: [PATCH] Fixed building with newer GNUTLS versions Konrad Rzeszutek Wilk
[not found] ` <CAGj-wbF_R7dgRyNyY6ydnvW-P1aV7-rVLfvkH3B_oyf0w0Fy5A@mail.gmail.com>
2016-04-01 16:45 ` Konrad Rzeszutek Wilk
2016-05-03 16:18 ` Konrad Rzeszutek Wilk
2016-05-03 16:35 ` Wei Liu
2016-05-03 16:49 ` Konrad Rzeszutek Wilk
2016-05-03 16:52 ` Wei Liu
2016-05-04 10:28 ` Wei Liu
2016-05-04 13:06 ` Olaf Hering
2016-05-04 13:29 ` Wei Liu
2016-05-04 13:38 ` Olaf Hering
2016-05-04 13:50 ` Wei Liu
2016-05-04 14:03 ` Olaf Hering
2016-05-04 14:08 ` Wei Liu
2016-05-04 14:13 ` Olaf Hering
2016-05-04 14:16 ` Wei Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1459457899-24651-1-git-send-email-sfjuocekr@gmail.com \
--to=sfjuocekr@gmail.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).