[gtk-vnc] Don't short-circuit request for TLS credentials
- From: Daniel P. Berrange <dberrange src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [gtk-vnc] Don't short-circuit request for TLS credentials
- Date: Wed, 31 Jan 2018 11:11:42 +0000 (UTC)
commit df656c79467c2595b4a2cd35283c7f5d52adf336
Author: Daniel P. Berrangé <berrange redhat com>
Date: Wed Jan 31 11:09:38 2018 +0000
Don't short-circuit request for TLS credentials
Although newer GNUTLS has a default system trust fallback for CA
certificates, we must still request certificates from the client app. If
we do not, then the VNC client will never be given the opportunity to
provide custom certs to override the system trust database.
Signed-off-by: Daniel P. Berrangé <berrange redhat com>
src/vncconnection.c | 8 --------
1 files changed, 0 insertions(+), 8 deletions(-)
---
diff --git a/src/vncconnection.c b/src/vncconnection.c
index b832ece..7a7ee8a 100644
--- a/src/vncconnection.c
+++ b/src/vncconnection.c
@@ -3530,16 +3530,8 @@ static gboolean vnc_connection_has_credentials(gpointer data)
return FALSE;
if (priv->want_cred_password && !priv->cred_password)
return FALSE;
- /*
- * For x509 we require a minimum of the CA cert
- * if using GNUTLS < 3.0. With newer GNUTLS we'll
- * fallback to the system trust, so don't need to
- * explicitly check for a CA cert.
- */
-#if GNUTLS_VERSION_NUMBER < 0x030000
if (priv->want_cred_x509 && !priv->cred_x509_cacert)
return FALSE;
-#endif
return TRUE;
}
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]