|
 |
bf78cb |
From a6ef11572ffdfde69c901c8c4903c911f0e27d76 Mon Sep 17 00:00:00 2001
|
|
|
bf78cb |
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
|
|
bf78cb |
Date: Wed, 31 Jan 2018 11:09:38 +0000
|
|
|
bf78cb |
Subject: [PATCH] Don't short-circuit request for TLS credentials
|
|
|
bf78cb |
MIME-Version: 1.0
|
|
|
bf78cb |
Content-Type: text/plain; charset=UTF-8
|
|
|
bf78cb |
Content-Transfer-Encoding: 8bit
|
|
|
bf78cb |
|
|
|
bf78cb |
Although newer GNUTLS has a default system trust fallback for CA
|
|
|
bf78cb |
certificates, we must still request certificates from the client app. If
|
|
|
bf78cb |
we do not, then the VNC client will never be given the opportunity to
|
|
|
bf78cb |
provide custom certs to override the system trust database.
|
|
|
bf78cb |
|
|
|
bf78cb |
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
|
bf78cb |
(cherry picked from commit df656c79467c2595b4a2cd35283c7f5d52adf336)
|
|
|
bf78cb |
---
|
|
|
bf78cb |
src/vncconnection.c | 8 --------
|
|
|
bf78cb |
1 file changed, 8 deletions(-)
|
|
|
bf78cb |
|
|
|
bf78cb |
diff --git a/src/vncconnection.c b/src/vncconnection.c
|
|
|
bf78cb |
index 1ddf38d..e5496ef 100644
|
|
|
bf78cb |
--- a/src/vncconnection.c
|
|
|
bf78cb |
+++ b/src/vncconnection.c
|
|
|
bf78cb |
@@ -3528,16 +3528,8 @@ static gboolean vnc_connection_has_credentials(gpointer data)
|
|
|
bf78cb |
return FALSE;
|
|
|
bf78cb |
if (priv->want_cred_password && !priv->cred_password)
|
|
|
bf78cb |
return FALSE;
|
|
|
bf78cb |
- /*
|
|
|
bf78cb |
- * For x509 we require a minimum of the CA cert
|
|
|
bf78cb |
- * if using GNUTLS < 3.0. With newer GNUTLS we'll
|
|
|
bf78cb |
- * fallback to the system trust, so don't need to
|
|
|
bf78cb |
- * explicitly check for a CA cert.
|
|
|
bf78cb |
- */
|
|
|
bf78cb |
-#if GNUTLS_VERSION_NUMBER < 0x030000
|
|
|
bf78cb |
if (priv->want_cred_x509 && !priv->cred_x509_cacert)
|
|
|
bf78cb |
return FALSE;
|
|
|
bf78cb |
-#endif
|
|
|
bf78cb |
return TRUE;
|
|
|
bf78cb |
}
|
|
|
bf78cb |
|