[gtk-vnc] Don't short-circuit request for TLS credentials



commit df656c79467c2595b4a2cd35283c7f5d52adf336
Author: Daniel P. Berrangé <berrange redhat com>
Date:   Wed Jan 31 11:09:38 2018 +0000

    Don't short-circuit request for TLS credentials
    
    Although newer GNUTLS has a default system trust fallback for CA
    certificates, we must still request certificates from the client app. If
    we do not, then the VNC client will never be given the opportunity to
    provide custom certs to override the system trust database.
    
    Signed-off-by: Daniel P. Berrangé <berrange redhat com>

 src/vncconnection.c |    8 --------
 1 files changed, 0 insertions(+), 8 deletions(-)
---
diff --git a/src/vncconnection.c b/src/vncconnection.c
index b832ece..7a7ee8a 100644
--- a/src/vncconnection.c
+++ b/src/vncconnection.c
@@ -3530,16 +3530,8 @@ static gboolean vnc_connection_has_credentials(gpointer data)
         return FALSE;
     if (priv->want_cred_password && !priv->cred_password)
         return FALSE;
-    /*
-     * For x509 we require a minimum of the CA cert
-     * if using GNUTLS < 3.0. With newer GNUTLS we'll
-     * fallback to the system trust, so don't need to
-     * explicitly check for a CA cert.
-     */
-#if GNUTLS_VERSION_NUMBER < 0x030000
     if (priv->want_cred_x509 && !priv->cred_x509_cacert)
         return FALSE;
-#endif
     return TRUE;
 }
 


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]