gnutls-3.patch revision 1601
1601N/AGnuTLS 3 support from upstream, extracted from these commits and backported
1601N/Ato TigerVNC 1.1 (including use of automake instead of Cmake):
1601N/A
1601N/AFrom fe48cd4d2427c0262cd58b30c74331a9fce756c7 Mon Sep 17 00:00:00 2001
1601N/AFrom: Pierre Ossman <ossman@cendio.se>
1601N/ADate: Tue, 3 Jul 2012 14:43:38 +0000
1601N/ASubject: [PATCH] Refactor the TLS code so that the push/pull functions are
1601N/A aware of their containing stream object. This is in
1601N/A preparation for supporting GnuTLS 3.x.
1601N/A
1601N/Agit-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4921 3789f03b-4d11-0410-bbf8-ca57d06f2519
1601N/A---
1601N/AFrom 2137f4f78f2b80faf96707907cd08562d83f1216 Mon Sep 17 00:00:00 2001
1601N/AFrom: Pierre Ossman <ossman@cendio.se>
1601N/ADate: Tue, 3 Jul 2012 14:52:26 +0000
1601N/ASubject: [PATCH] GnuTLS 3.x has removed gnutls_transport_set_global_errno()
1601N/A in favour of gnutls_transport_set_errno(). Make sure we
1601N/A call the right errno function depending on which GnuTLS
1601N/A we're using.
1601N/A
1601N/Agit-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4922 3789f03b-4d11-0410-bbf8-ca57d06f2519
1601N/A---
1601N/AFrom 88c24edd8f7a793561104be50b6ecf2c85b42956 Mon Sep 17 00:00:00 2001
1601N/AFrom: Pierre Ossman <ossman@cendio.se>
1601N/ADate: Thu, 29 Jan 2015 13:12:22 +0100
1601N/ASubject: [PATCH] Raise GnuTLS requirements to 3.x
1601N/A
1601N/AThis allows us to simplify things by getting rid of some old
1601N/Acompatibility code. People should really be using current versions
1601N/Aof GnuTLS anyway to stay secure.
1601N/A---
1601N/AFrom 27eb55e1975c4f558f6a53d573091e76064cc8e7 Mon Sep 17 00:00:00 2001
1601N/AFrom: Pierre Ossman <ossman@cendio.se>
1601N/ADate: Thu, 29 Jan 2015 13:31:06 +0100
1601N/ASubject: [PATCH] Add parameter to override GnuTLS priority
1601N/A
1601N/A---
1601N/AFrom 660f1081d7cd1e4c763675ace8181ed34d377d34 Mon Sep 17 00:00:00 2001
1601N/AFrom: Pierre Ossman <ossman@cendio.se>
1601N/ADate: Wed, 2 Mar 2011 12:44:12 +0000
1601N/ASubject: [PATCH] Make it easier to read string parameters by providing an
1601N/A implicit conversion to const char*.
1601N/A
1601N/Agit-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4307 3789f03b-4d11-0410-bbf8-ca57d06f2519
1601N/A---
1601N/A
1601N/Adiff --git a/common/os/Makefile.am b/common/os/Makefile.am
1601N/Aindex ab4f2d7..d87a0da 100644
1601N/A--- a/common/os/Makefile.am
1601N/A+++ b/common/os/Makefile.am
1601N/A@@ -1,8 +1,8 @@
1601N/A noinst_LTLIBRARIES = libos.la
1601N/A
1601N/A-HDRS = net.h print.h os.h tls.h
1601N/A+HDRS = net.h print.h os.h
1601N/A
1601N/A-libos_la_SOURCES = $(HDRS) print.c net.c os.cxx tls.cxx
1601N/A+libos_la_SOURCES = $(HDRS) print.c net.c os.cxx
1601N/A
1601N/A libos_la_CPPFLAGS = -I$(top_srcdir)/common
1601N/A
1601N/Adiff --git a/common/os/tls.cxx b/./prev/common/os/tls.cxx
1601N/Adeleted file mode 100644
1601N/Aindex c092996..0000000
1601N/A--- a/common/os/tls.cxx
1601N/A+++ /dev/null
1601N/A@@ -1,198 +0,0 @@
1601N/A-/* Copyright (C) 2011 TightVNC Team. All Rights Reserved.
1601N/A- *
1601N/A- * This is free software; you can redistribute it and/or modify
1601N/A- * it under the terms of the GNU General Public License as published by
1601N/A- * the Free Software Foundation; either version 2 of the License, or
1601N/A- * (at your option) any later version.
1601N/A- *
1601N/A- * This software is distributed in the hope that it will be useful,
1601N/A- * but WITHOUT ANY WARRANTY; without even the implied warranty of
1601N/A- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
1601N/A- * GNU General Public License for more details.
1601N/A- *
1601N/A- * You should have received a copy of the GNU General Public License
1601N/A- * along with this software; if not, write to the Free Software
1601N/A- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
1601N/A- * USA.
1601N/A- */
1601N/A-
1601N/A-#ifdef HAVE_CONFIG_H
1601N/A-#include <config.h>
1601N/A-#endif
1601N/A-
1601N/A-#include <os/tls.h>
1601N/A-
1601N/A-#include <iomanip>
1601N/A-#include <stdio.h>
1601N/A-#include <stdlib.h>
1601N/A-#include <string.h>
1601N/A-#include <sstream>
1601N/A-#include <sys/types.h>
1601N/A-#include <time.h>
1601N/A-
1601N/A-using namespace std;
1601N/A-
1601N/A-#if defined(HAVE_GNUTLS) && !defined(WIN32)
1601N/A-#include <gnutls/gnutls.h>
1601N/A-#include <gnutls/x509.h>
1601N/A-
1601N/A-#ifndef HAVE_GNUTLS_X509_CRT_PRINT
1601N/A-
1601N/A-/* Ancient GNUTLS... */
1601N/A-#if !defined(GNUTLS_VERSION_NUMBER) && !defined(LIBGNUTLS_VERSION_NUMBER)
1601N/A-#define GNUTLS_DIG_SHA1 GNUTLS_DIG_SHA
1601N/A-#endif
1601N/A-
1601N/A-#define UNKNOWN_SUBJECT(err) \
1601N/A- do { \
1601N/A- ss << "unknown subject (" << gnutls_strerror(err) << "), "; \
1601N/A- } while (0)
1601N/A-
1601N/A-#define UNKNOWN_ISSUER(err) \
1601N/A- do { \
1601N/A- ss << "unknown issuer (" << gnutls_strerror(err) << "), "; \
1601N/A- } while (0)
1601N/A-
1601N/A-
1601N/A-static void
1601N/A-hexprint(ostringstream &ss, const char *data, size_t len)
1601N/A-{
1601N/A- size_t j;
1601N/A- char tmp[3];
1601N/A-
1601N/A- if (len == 0)
1601N/A- ss << "00";
1601N/A- else {
1601N/A- for (j = 0; j < len; j++) {
1601N/A- snprintf(tmp, sizeof(tmp), "%.2x", (unsigned char) data[j]);
1601N/A- ss << tmp;
1601N/A- }
1601N/A- }
1601N/A-}
1601N/A-
1601N/A-/* Implementation based on gnutls_x509_crt_print from GNUTLS */
1601N/A-int
1601N/A-gnutls_x509_crt_print(gnutls_x509_crt_t cert,
1601N/A- gnutls_certificate_print_formats_t format,
1601N/A- gnutls_datum_t * out)
1601N/A-{
1601N/A- ostringstream ss;
1601N/A-
1601N/A- int err;
1601N/A-
1601N/A- char *dn;
1601N/A- size_t dn_size = 0;
1601N/A-
1601N/A- /* Subject */
1601N/A- err = gnutls_x509_crt_get_dn(cert, NULL, &dn_size);
1601N/A- if (err != GNUTLS_E_SHORT_MEMORY_BUFFER)
1601N/A- UNKNOWN_SUBJECT(err);
1601N/A- else {
1601N/A- dn = (char *)malloc(dn_size);
1601N/A- if (dn == NULL) {
1601N/A- UNKNOWN_SUBJECT(GNUTLS_E_MEMORY_ERROR);
1601N/A- } else {
1601N/A- err = gnutls_x509_crt_get_dn(cert, dn, &dn_size);
1601N/A- if (err < 0) {
1601N/A- UNKNOWN_SUBJECT(err);
1601N/A- } else
1601N/A- ss << "subject `" << dn << "', ";
1601N/A- free(dn);
1601N/A- }
1601N/A- }
1601N/A-
1601N/A- /* Issuer */
1601N/A- dn = NULL;
1601N/A- dn_size = 0;
1601N/A- err = gnutls_x509_crt_get_issuer_dn(cert, NULL, &dn_size);
1601N/A- if (err != GNUTLS_E_SHORT_MEMORY_BUFFER)
1601N/A- UNKNOWN_ISSUER(err);
1601N/A- else {
1601N/A- dn = (char *)malloc(dn_size);
1601N/A- if (dn == NULL) {
1601N/A- UNKNOWN_ISSUER(GNUTLS_E_MEMORY_ERROR);
1601N/A- } else {
1601N/A- err = gnutls_x509_crt_get_issuer_dn(cert, dn, &dn_size);
1601N/A- if (err < 0)
1601N/A- UNKNOWN_ISSUER(err);
1601N/A- else
1601N/A- ss << "issuer `" << dn << "', ";
1601N/A- free(dn);
1601N/A- }
1601N/A- }
1601N/A-
1601N/A- /* Key algorithm and size */
1601N/A- unsigned int bits;
1601N/A- const char *name;
1601N/A- name = gnutls_pk_algorithm_get_name( (gnutls_pk_algorithm_t)
1601N/A- gnutls_x509_crt_get_pk_algorithm(cert, &bits));
1601N/A- if (name == NULL)
1601N/A- name = "Unknown";
1601N/A- ss << name << " key " << bits << " bits, ";
1601N/A-
1601N/A- /* Signature algorithm */
1601N/A- err = gnutls_x509_crt_get_signature_algorithm(cert);
1601N/A- if (err < 0) {
1601N/A- ss << "unknown signature algorithm (" << gnutls_strerror(err)
1601N/A- << "), ";
1601N/A- } else {
1601N/A- const char *name;
1601N/A- name = gnutls_sign_algorithm_get_name((gnutls_sign_algorithm_t)err);
1601N/A- if (name == NULL)
1601N/A- name = "Unknown";
1601N/A-
1601N/A- ss << "signed using " << name;
1601N/A- if (err == GNUTLS_SIGN_RSA_MD5 || err == GNUTLS_SIGN_RSA_MD2)
1601N/A- ss << " (broken!)";
1601N/A- ss << ", ";
1601N/A- }
1601N/A-
1601N/A- /* Validity */
1601N/A- time_t tim;
1601N/A- char s[42];
1601N/A- size_t max = sizeof(s);
1601N/A- struct tm t;
1601N/A-
1601N/A- tim = gnutls_x509_crt_get_activation_time(cert);
1601N/A- if (gmtime_r(&tim, &t) == NULL)
1601N/A- ss << "unknown activation (" << (unsigned long) tim << ")";
1601N/A- else if (strftime(s, max, "%Y-%m-%d %H:%M:%S UTC", &t) == 0)
1601N/A- ss << "failed activation (" << (unsigned long) tim << ")";
1601N/A- else
1601N/A- ss << "activated `" << s << "'";
1601N/A- ss << ", ";
1601N/A-
1601N/A- tim = gnutls_x509_crt_get_expiration_time(cert);
1601N/A- if (gmtime_r(&tim, &t) == NULL)
1601N/A- ss << "unknown expiry (" << (unsigned long) tim << ")";
1601N/A- else if (strftime(s, max, "%Y-%m-%d %H:%M:%S UTC", &t) == 0)
1601N/A- ss << "failed expiry (" << (unsigned long) tim << ")";
1601N/A- else
1601N/A- ss << "expires `" << s << "'";
1601N/A- ss << ", ";
1601N/A-
1601N/A- /* Fingerprint */
1601N/A- char buffer[20];
1601N/A- size_t size = sizeof(buffer);
1601N/A-
1601N/A- err = gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA1, buffer, &size);
1601N/A- if (err < 0)
1601N/A- ss << "unknown fingerprint (" << gnutls_strerror(err) << ")";
1601N/A- else {
1601N/A- ss << "SHA-1 fingerprint `";
1601N/A- hexprint(ss, buffer, size);
1601N/A- ss << "'";
1601N/A- }
1601N/A-
1601N/A- out->data = (unsigned char *) strdup(ss.str().c_str());
1601N/A- if (out->data == NULL)
1601N/A- return GNUTLS_E_MEMORY_ERROR;
1601N/A- out->size = strlen((char *)out->data);
1601N/A-
1601N/A- return 0;
1601N/A-}
1601N/A-
1601N/A-#endif /* HAVE_GNUTLS_X509_CRT_PRINT */
1601N/A-
1601N/A-#endif /* HAVE_GNUTLS */
1601N/A-
1601N/Adiff --git a/common/os/tls.h b/./prev/common/os/tls.h
1601N/Adeleted file mode 100644
1601N/Aindex 8980197..0000000
1601N/A--- a/common/os/tls.h
1601N/A+++ /dev/null
1601N/A@@ -1,63 +0,0 @@
1601N/A-/* Copyright (C) 2011 TightVNC Team. All Rights Reserved.
1601N/A- *
1601N/A- * This is free software; you can redistribute it and/or modify
1601N/A- * it under the terms of the GNU General Public License as published by
1601N/A- * the Free Software Foundation; either version 2 of the License, or
1601N/A- * (at your option) any later version.
1601N/A- *
1601N/A- * This software is distributed in the hope that it will be useful,
1601N/A- * but WITHOUT ANY WARRANTY; without even the implied warranty of
1601N/A- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
1601N/A- * GNU General Public License for more details.
1601N/A- *
1601N/A- * You should have received a copy of the GNU General Public License
1601N/A- * along with this software; if not, write to the Free Software
1601N/A- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
1601N/A- * USA.
1601N/A- */
1601N/A-
1601N/A-#ifndef OS_TLS_H
1601N/A-#define OS_TLS_H
1601N/A-
1601N/A-#ifdef HAVE_CONFIG_H
1601N/A-#include <config.h>
1601N/A-#endif
1601N/A-
1601N/A-/*
1601N/A- * Windows builds are build against fairly new GNUTLS, ignore compatibility
1601N/A- * code.
1601N/A- */
1601N/A-#if defined(HAVE_GNUTLS) && !defined(WIN32)
1601N/A-#include <gnutls/gnutls.h>
1601N/A-
1601N/A-#ifndef HAVE_GNUTLS_DATUM_T
1601N/A-typedef gnutls_datum gnutls_datum_t;
1601N/A-#endif
1601N/A-#ifndef HAVE_GNUTLS_CRT_T
1601N/A-typedef gnutls_x509_crt gnutls_x509_crt_t;
1601N/A-#endif
1601N/A-#ifndef HAVE_GNUTLS_PK_ALGORITHM_T
1601N/A-typedef gnutls_pk_algorithm gnutls_pk_algorithm_t;
1601N/A-#endif
1601N/A-#ifndef HAVE_GNUTLS_SIGN_ALGORITHM_T
1601N/A-typedef gnutls_sign_algorithm gnutls_sign_algorithm_t;
1601N/A-#endif
1601N/A-
1601N/A-#ifndef HAVE_GNUTLS_X509_CRT_PRINT
1601N/A-
1601N/A-typedef enum {
1601N/A- GNUTLS_CRT_PRINT_ONELINE = 1
1601N/A-} gnutls_certificate_print_formats_t;
1601N/A-
1601N/A-/*
1601N/A- * Prints certificate in human-readable form.
1601N/A- */
1601N/A-int
1601N/A-gnutls_x509_crt_print(gnutls_x509_crt_t cert,
1601N/A- gnutls_certificate_print_formats_t format,
1601N/A- gnutls_datum_t * out);
1601N/A-#endif /* HAVE_GNUTLS_X509_CRT_PRINT */
1601N/A-#endif /* HAVE_GNUTLS */
1601N/A-
1601N/A-#endif /* OS_TLS_H */
1601N/A-
1601N/Adiff --git a/common/rdr/TLSInStream.cxx b/common/rdr/TLSInStream.cxx
1601N/Aindex ddc9991..ef030c1 100644
1601N/A--- a/common/rdr/TLSInStream.cxx
1601N/A+++ b/common/rdr/TLSInStream.cxx
1601N/A@@ -27,23 +27,19 @@
1601N/A #include <rdr/TLSInStream.h>
1601N/A #include <errno.h>
1601N/A
1601N/A-#ifdef HAVE_OLD_GNUTLS
1601N/A-#define gnutls_transport_set_global_errno(A) do { errno = (A); } while(0)
1601N/A-#endif
1601N/A-
1601N/A #ifdef HAVE_GNUTLS
1601N/A using namespace rdr;
1601N/A
1601N/A enum { DEFAULT_BUF_SIZE = 16384 };
1601N/A
1601N/A-ssize_t rdr::gnutls_InStream_pull(gnutls_transport_ptr str, void* data,
1601N/A- size_t size)
1601N/A+ssize_t TLSInStream::pull(gnutls_transport_ptr_t str, void* data, size_t size)
1601N/A {
1601N/A- InStream* in= (InStream*) str;
1601N/A+ TLSInStream* self= (TLSInStream*) str;
1601N/A+ InStream *in = self->in;
1601N/A
1601N/A try {
1601N/A if (!in->check(1, 1, false)) {
1601N/A- gnutls_transport_set_global_errno(EAGAIN);
1601N/A+ gnutls_transport_set_errno(self->session, EAGAIN);
1601N/A return -1;
1601N/A }
1601N/A
1601N/A@@ -53,21 +49,29 @@ ssize_t rdr::gnutls_InStream_pull(gnutls_transport_ptr str, void* data,
1601N/A in->readBytes(data, size);
1601N/A
1601N/A } catch (Exception& e) {
1601N/A- gnutls_transport_set_global_errno(EINVAL);
1601N/A+ gnutls_transport_set_errno(self->session, EINVAL);
1601N/A return -1;
1601N/A }
1601N/A
1601N/A return size;
1601N/A }
1601N/A
1601N/A-TLSInStream::TLSInStream(InStream* _in, gnutls_session _session)
1601N/A+TLSInStream::TLSInStream(InStream* _in, gnutls_session_t _session)
1601N/A : session(_session), in(_in), bufSize(DEFAULT_BUF_SIZE), offset(0)
1601N/A {
1601N/A+ gnutls_transport_ptr_t recv, send;
1601N/A+
1601N/A ptr = end = start = new U8[bufSize];
1601N/A+
1601N/A+ gnutls_transport_set_pull_function(session, pull);
1601N/A+ gnutls_transport_get_ptr2(session, &recv, &send);
1601N/A+ gnutls_transport_set_ptr2(session, this, send);
1601N/A }
1601N/A
1601N/A TLSInStream::~TLSInStream()
1601N/A {
1601N/A+ gnutls_transport_set_pull_function(session, NULL);
1601N/A+
1601N/A delete[] start;
1601N/A }
1601N/A
1601N/Adiff --git a/common/rdr/TLSInStream.h b/common/rdr/TLSInStream.h
1601N/Aindex 7fad6fa..b16d9f5 100644
1601N/A--- a/common/rdr/TLSInStream.h
1601N/A+++ b/common/rdr/TLSInStream.h
1601N/A@@ -33,7 +33,7 @@ namespace rdr {
1601N/A
1601N/A class TLSInStream : public InStream {
1601N/A public:
1601N/A- TLSInStream(InStream* in, gnutls_session session);
1601N/A+ TLSInStream(InStream* in, gnutls_session_t session);
1601N/A virtual ~TLSInStream();
1601N/A
1601N/A int pos();
1601N/A@@ -41,16 +41,14 @@ namespace rdr {
1601N/A private:
1601N/A int overrun(int itemSize, int nItems, bool wait);
1601N/A int readTLS(U8* buf, int len, bool wait);
1601N/A+ static ssize_t pull(gnutls_transport_ptr_t str, void* data, size_t size);
1601N/A
1601N/A- gnutls_session session;
1601N/A+ gnutls_session_t session;
1601N/A InStream* in;
1601N/A int bufSize;
1601N/A int offset;
1601N/A U8* start;
1601N/A };
1601N/A-
1601N/A- ssize_t gnutls_InStream_pull(gnutls_transport_ptr,void*, size_t);
1601N/A-
1601N/A };
1601N/A
1601N/A #endif
1601N/Adiff --git a/common/rdr/TLSOutStream.cxx b/common/rdr/TLSOutStream.cxx
1601N/Aindex d577ccc..44d2d9f 100644
1601N/A--- a/common/rdr/TLSOutStream.cxx
1601N/A+++ b/common/rdr/TLSOutStream.cxx
1601N/A@@ -27,36 +27,39 @@
1601N/A #include <rdr/TLSOutStream.h>
1601N/A #include <errno.h>
1601N/A
1601N/A-#ifdef HAVE_OLD_GNUTLS
1601N/A-#define gnutls_transport_set_global_errno(A) do { errno = (A); } while(0)
1601N/A-#endif
1601N/A-
1601N/A #ifdef HAVE_GNUTLS
1601N/A using namespace rdr;
1601N/A
1601N/A enum { DEFAULT_BUF_SIZE = 16384 };
1601N/A
1601N/A-ssize_t rdr::gnutls_OutStream_push(gnutls_transport_ptr str, const void* data,
1601N/A+ssize_t TLSOutStream::push(gnutls_transport_ptr_t str, const void* data,
1601N/A size_t size)
1601N/A {
1601N/A- OutStream* out = (OutStream*) str;
1601N/A+ TLSOutStream* self= (TLSOutStream*) str;
1601N/A+ OutStream *out = self->out;
1601N/A
1601N/A try {
1601N/A out->writeBytes(data, size);
1601N/A out->flush();
1601N/A } catch (Exception& e) {
1601N/A- gnutls_transport_set_global_errno(EINVAL);
1601N/A+ gnutls_transport_set_errno(self->session, EINVAL);
1601N/A return -1;
1601N/A }
1601N/A
1601N/A return size;
1601N/A }
1601N/A
1601N/A-TLSOutStream::TLSOutStream(OutStream* _out, gnutls_session _session)
1601N/A+TLSOutStream::TLSOutStream(OutStream* _out, gnutls_session_t _session)
1601N/A : session(_session), out(_out), bufSize(DEFAULT_BUF_SIZE), offset(0)
1601N/A {
1601N/A+ gnutls_transport_ptr_t recv, send;
1601N/A+
1601N/A ptr = start = new U8[bufSize];
1601N/A end = start + bufSize;
1601N/A+
1601N/A+ gnutls_transport_set_push_function(session, push);
1601N/A+ gnutls_transport_get_ptr2(session, &recv, &send);
1601N/A+ gnutls_transport_set_ptr2(session, recv, this);
1601N/A }
1601N/A
1601N/A TLSOutStream::~TLSOutStream()
1601N/A@@ -67,6 +70,8 @@ TLSOutStream::~TLSOutStream()
1601N/A } catch (Exception&) {
1601N/A }
1601N/A #endif
1601N/A+ gnutls_transport_set_push_function(session, NULL);
1601N/A+
1601N/A delete [] start;
1601N/A }
1601N/A
1601N/Adiff --git a/common/rdr/TLSOutStream.h b/common/rdr/TLSOutStream.h
1601N/Aindex 5eb512e..81dd237 100644
1601N/A--- a/common/rdr/TLSOutStream.h
1601N/A+++ b/common/rdr/TLSOutStream.h
1601N/A@@ -32,7 +32,7 @@ namespace rdr {
1601N/A
1601N/A class TLSOutStream : public OutStream {
1601N/A public:
1601N/A- TLSOutStream(OutStream* out, gnutls_session session);
1601N/A+ TLSOutStream(OutStream* out, gnutls_session_t session);
1601N/A virtual ~TLSOutStream();
1601N/A
1601N/A void flush();
1601N/A@@ -43,15 +43,14 @@ namespace rdr {
1601N/A
1601N/A private:
1601N/A int writeTLS(const U8* data, int length);
1601N/A+ static ssize_t push(gnutls_transport_ptr_t str, const void* data, size_t size);
1601N/A
1601N/A- gnutls_session session;
1601N/A+ gnutls_session_t session;
1601N/A OutStream* out;
1601N/A int bufSize;
1601N/A U8* start;
1601N/A int offset;
1601N/A };
1601N/A-
1601N/A- ssize_t gnutls_OutStream_push(gnutls_transport_ptr, const void*, size_t);
1601N/A };
1601N/A
1601N/A #endif
1601N/Adiff --git a/common/rfb/Configuration.cxx b/common/rfb/Configuration.cxx
1601N/Aindex e9eee1a..8137501 100644
1601N/A--- a/common/rfb/Configuration.cxx
1601N/A+++ b/common/rfb/Configuration.cxx
1601N/A@@ -444,6 +444,10 @@ char* StringParameter::getValueStr() const {
1601N/A return strDup(value);
1601N/A }
1601N/A
1601N/A+StringParameter::operator const char *() const {
1601N/A+ return value;
1601N/A+}
1601N/A+
1601N/A // -=- BinaryParameter
1601N/A
1601N/A BinaryParameter::BinaryParameter(const char* name_, const char* desc_,
1601N/Adiff --git a/common/rfb/Configuration.h b/common/rfb/Configuration.h
1601N/Aindex 276651d..35e31fc 100644
1601N/A--- a/common/rfb/Configuration.h
1601N/A+++ b/common/rfb/Configuration.h
1601N/A@@ -241,6 +241,7 @@ namespace rfb {
1601N/A virtual char* getDefaultStr() const;
1601N/A virtual char* getValueStr() const;
1601N/A void setDefaultStr(const char* v);
1601N/A+ operator const char*() const;
1601N/A
1601N/A // getData() returns a copy of the data - it must be delete[]d by the
1601N/A // caller.
1601N/Adiff --git a/common/rfb/CSecurityTLS.cxx b/common/rfb/CSecurityTLS.cxx
1601N/Aindex 3421de5..a60dbdd 100644
1601N/A--- a/common/rfb/CSecurityTLS.cxx
1601N/A+++ b/common/rfb/CSecurityTLS.cxx
1601N/A@@ -43,7 +43,6 @@
1601N/A #include <rdr/TLSOutStream.h>
1601N/A #include <os/os.h>
1601N/A #include <os/print.h>
1601N/A-#include <os/tls.h>
1601N/A
1601N/A #include <gnutls/x509.h>
1601N/A
1601N/A@@ -188,20 +187,20 @@ bool CSecurityTLS::processMsg(CConnection* cc)
1601N/A throw AuthFailureException("gnutls_set_default_priority failed");
1601N/A
1601N/A setParam();
1601N/A-
1601N/A- gnutls_transport_set_pull_function(session, rdr::gnutls_InStream_pull);
1601N/A- gnutls_transport_set_push_function(session, rdr::gnutls_OutStream_push);
1601N/A- gnutls_transport_set_ptr2(session,
1601N/A- (gnutls_transport_ptr) is,
1601N/A- (gnutls_transport_ptr) os);
1601N/A }
1601N/A
1601N/A+ rdr::TLSInStream *tlsis = new rdr::TLSInStream(is, session);
1601N/A+ rdr::TLSOutStream *tlsos = new rdr::TLSOutStream(os, session);
1601N/A+
1601N/A int err;
1601N/A err = gnutls_handshake(session);
1601N/A- if (err != GNUTLS_E_SUCCESS && !gnutls_error_is_fatal(err))
1601N/A- return false;
1601N/A-
1601N/A if (err != GNUTLS_E_SUCCESS) {
1601N/A+ delete tlsis;
1601N/A+ delete tlsos;
1601N/A+
1601N/A+ if (!gnutls_error_is_fatal(err))
1601N/A+ return false;
1601N/A+
1601N/A vlog.error("TLS Handshake failed: %s\n", gnutls_strerror (err));
1601N/A shutdown(false);
1601N/A throw AuthFailureException("TLS Handshake failed");
1601N/A@@ -209,22 +208,39 @@ bool CSecurityTLS::processMsg(CConnection* cc)
1601N/A
1601N/A checkSession();
1601N/A
1601N/A- cc->setStreams(fis = new rdr::TLSInStream(is, session),
1601N/A- fos = new rdr::TLSOutStream(os, session));
1601N/A+ cc->setStreams(fis = tlsis, fos = tlsos);
1601N/A
1601N/A return true;
1601N/A }
1601N/A
1601N/A void CSecurityTLS::setParam()
1601N/A {
1601N/A- static const int kx_anon_priority[] = { GNUTLS_KX_ANON_DH, 0 };
1601N/A- static const int kx_priority[] = { GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA,
1601N/A- GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0 };
1601N/A+ static const char kx_anon_priority[] = ":+ANON-ECDH:+ANON-DH";
1601N/A
1601N/A- if (anon) {
1601N/A- if (gnutls_kx_set_priority(session, kx_anon_priority) != GNUTLS_E_SUCCESS)
1601N/A- throw AuthFailureException("gnutls_kx_set_priority failed");
1601N/A+ int ret;
1601N/A+ char *prio;
1601N/A+ const char *err;
1601N/A+
1601N/A+ prio = (char*)malloc(strlen(Security::GnuTLSPriority) +
1601N/A+ strlen(kx_anon_priority) + 1);
1601N/A+ if (prio == NULL)
1601N/A+ throw AuthFailureException("Not enough memory for GnuTLS priority string");
1601N/A
1601N/A+ strcpy(prio, Security::GnuTLSPriority);
1601N/A+ if (anon)
1601N/A+ strcat(prio, kx_anon_priority);
1601N/A+
1601N/A+ ret = gnutls_priority_set_direct(session, prio, &err);
1601N/A+
1601N/A+ free(prio);
1601N/A+
1601N/A+ if (ret != GNUTLS_E_SUCCESS) {
1601N/A+ if (ret == GNUTLS_E_INVALID_REQUEST)
1601N/A+ vlog.error("GnuTLS priority syntax error at: %s", err);
1601N/A+ throw AuthFailureException("gnutls_set_priority_direct failed");
1601N/A+ }
1601N/A+
1601N/A+ if (anon) {
1601N/A if (gnutls_anon_allocate_client_credentials(&anon_cred) != GNUTLS_E_SUCCESS)
1601N/A throw AuthFailureException("gnutls_anon_allocate_client_credentials failed");
1601N/A
1601N/A@@ -233,9 +249,6 @@ void CSecurityTLS::setParam()
1601N/A
1601N/A vlog.debug("Anonymous session has been set");
1601N/A } else {
1601N/A- if (gnutls_kx_set_priority(session, kx_priority) != GNUTLS_E_SUCCESS)
1601N/A- throw AuthFailureException("gnutls_kx_set_priority failed");
1601N/A-
1601N/A if (gnutls_certificate_allocate_credentials(&cert_cred) != GNUTLS_E_SUCCESS)
1601N/A throw AuthFailureException("gnutls_certificate_allocate_credentials failed");
1601N/A
1601N/A@@ -274,10 +287,10 @@ void CSecurityTLS::checkSession()
1601N/A GNUTLS_CERT_SIGNER_NOT_FOUND |
1601N/A GNUTLS_CERT_SIGNER_NOT_CA;
1601N/A unsigned int status;
1601N/A- const gnutls_datum *cert_list;
1601N/A+ const gnutls_datum_t *cert_list;
1601N/A unsigned int cert_list_size = 0;
1601N/A int err;
1601N/A- gnutls_datum info;
1601N/A+ gnutls_datum_t info;
1601N/A
1601N/A if (anon)
1601N/A return;
1601N/A@@ -313,7 +326,7 @@ void CSecurityTLS::checkSession()
1601N/A throw AuthFailureException("empty certificate chain");
1601N/A
1601N/A /* Process only server's certificate, not issuer's certificate */
1601N/A- gnutls_x509_crt crt;
1601N/A+ gnutls_x509_crt_t crt;
1601N/A gnutls_x509_crt_init(&crt);
1601N/A
1601N/A if (gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER) < 0)
1601N/Adiff --git a/common/rfb/CSecurityTLS.h b/common/rfb/CSecurityTLS.h
1601N/Aindex c19307e..50aaf30 100644
1601N/A--- a/common/rfb/CSecurityTLS.h
1601N/A+++ b/common/rfb/CSecurityTLS.h
1601N/A@@ -64,9 +64,9 @@ namespace rfb {
1601N/A private:
1601N/A static void initGlobal();
1601N/A
1601N/A- gnutls_session session;
1601N/A- gnutls_anon_client_credentials anon_cred;
1601N/A- gnutls_certificate_credentials cert_cred;
1601N/A+ gnutls_session_t session;
1601N/A+ gnutls_anon_client_credentials_t anon_cred;
1601N/A+ gnutls_certificate_credentials_t cert_cred;
1601N/A bool anon;
1601N/A
1601N/A char *cafile, *crlfile;
1601N/Adiff --git a/common/rfb/SSecurityTLS.cxx b/common/rfb/SSecurityTLS.cxx
1601N/Aindex 2ea84e0..c2b1ded 100644
1601N/A--- a/common/rfb/SSecurityTLS.cxx
1601N/A+++ b/common/rfb/SSecurityTLS.cxx
1601N/A@@ -27,6 +27,8 @@
1601N/A #error "This source should not be compiled without HAVE_GNUTLS defined"
1601N/A #endif
1601N/A
1601N/A+#include <stdlib.h>
1601N/A+
1601N/A #include <rfb/SSecurityTLS.h>
1601N/A #include <rfb/SConnection.h>
1601N/A #include <rfb/LogWriter.h>
1601N/A@@ -148,17 +150,19 @@ bool SSecurityTLS::processMsg(SConnection *sc)
1601N/A throw;
1601N/A }
1601N/A
1601N/A- gnutls_transport_set_pull_function(session,rdr::gnutls_InStream_pull);
1601N/A- gnutls_transport_set_push_function(session,rdr::gnutls_OutStream_push);
1601N/A- gnutls_transport_set_ptr2(session,
1601N/A- (gnutls_transport_ptr)is,
1601N/A- (gnutls_transport_ptr)os);
1601N/A os->writeU8(1);
1601N/A os->flush();
1601N/A }
1601N/A
1601N/A+ rdr::TLSInStream *tlsis = new rdr::TLSInStream(is, session);
1601N/A+ rdr::TLSOutStream *tlsos = new rdr::TLSOutStream(os, session);
1601N/A+
1601N/A int err;
1601N/A- if ((err = gnutls_handshake(session)) != GNUTLS_E_SUCCESS) {
1601N/A+ err = gnutls_handshake(session);
1601N/A+ if (err != GNUTLS_E_SUCCESS) {
1601N/A+ delete tlsis;
1601N/A+ delete tlsos;
1601N/A+
1601N/A if (!gnutls_error_is_fatal(err)) {
1601N/A vlog.debug("Deferring completion of TLS handshake: %s", gnutls_strerror(err));
1601N/A return false;
1601N/A@@ -170,21 +174,37 @@ bool SSecurityTLS::processMsg(SConnection *sc)
1601N/A
1601N/A vlog.debug("Handshake completed");
1601N/A
1601N/A- sc->setStreams(fis=new rdr::TLSInStream(is,session),
1601N/A- fos=new rdr::TLSOutStream(os,session));
1601N/A+ sc->setStreams(fis = tlsis, fos = tlsos);
1601N/A
1601N/A return true;
1601N/A }
1601N/A
1601N/A-void SSecurityTLS::setParams(gnutls_session session)
1601N/A+void SSecurityTLS::setParams(gnutls_session_t session)
1601N/A {
1601N/A- static const int kx_anon_priority[] = { GNUTLS_KX_ANON_DH, 0 };
1601N/A- static const int kx_priority[] = { GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA,
1601N/A- GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0 };
1601N/A+ static const char kx_anon_priority[] = ":+ANON-ECDH:+ANON-DH";
1601N/A+
1601N/A+ int ret;
1601N/A+ char *prio;
1601N/A+ const char *err;
1601N/A+
1601N/A+ prio = (char*)malloc(strlen(Security::GnuTLSPriority) +
1601N/A+ strlen(kx_anon_priority) + 1);
1601N/A+ if (prio == NULL)
1601N/A+ throw AuthFailureException("Not enough memory for GnuTLS priority string");
1601N/A
1601N/A- if (gnutls_kx_set_priority(session, anon ? kx_anon_priority : kx_priority)
1601N/A- != GNUTLS_E_SUCCESS)
1601N/A- throw AuthFailureException("gnutls_kx_set_priority failed");
1601N/A+ strcpy(prio, Security::GnuTLSPriority);
1601N/A+ if (anon)
1601N/A+ strcat(prio, kx_anon_priority);
1601N/A+
1601N/A+ ret = gnutls_priority_set_direct(session, prio, &err);
1601N/A+
1601N/A+ free(prio);
1601N/A+
1601N/A+ if (ret != GNUTLS_E_SUCCESS) {
1601N/A+ if (ret == GNUTLS_E_INVALID_REQUEST)
1601N/A+ vlog.error("GnuTLS priority syntax error at: %s", err);
1601N/A+ throw AuthFailureException("gnutls_set_priority_direct failed");
1601N/A+ }
1601N/A
1601N/A if (gnutls_dh_params_init(&dh_params) != GNUTLS_E_SUCCESS)
1601N/A throw AuthFailureException("gnutls_dh_params_init failed");
1601N/Adiff --git a/common/rfb/SSecurityTLS.h b/common/rfb/SSecurityTLS.h
1601N/Aindex 4eebc7e..a793205 100644
1601N/A--- a/common/rfb/SSecurityTLS.h
1601N/A+++ b/common/rfb/SSecurityTLS.h
1601N/A@@ -51,15 +51,15 @@ namespace rfb {
1601N/A
1601N/A protected:
1601N/A void shutdown();
1601N/A- void setParams(gnutls_session session);
1601N/A+ void setParams(gnutls_session_t session);
1601N/A
1601N/A private:
1601N/A static void initGlobal();
1601N/A
1601N/A- gnutls_session session;
1601N/A- gnutls_dh_params dh_params;
1601N/A- gnutls_anon_server_credentials anon_cred;
1601N/A- gnutls_certificate_credentials cert_cred;
1601N/A+ gnutls_session_t session;
1601N/A+ gnutls_dh_params_t dh_params;
1601N/A+ gnutls_anon_server_credentials_t anon_cred;
1601N/A+ gnutls_certificate_credentials_t cert_cred;
1601N/A char *keyfile, *certfile;
1601N/A
1601N/A int type;
1601N/Adiff --git a/common/rfb/Security.cxx b/common/rfb/Security.cxx
1601N/Aindex e51c891..342aa8f 100644
1601N/A--- a/common/rfb/Security.cxx
1601N/A+++ b/common/rfb/Security.cxx
1601N/A@@ -52,6 +52,12 @@ using namespace std;
1601N/A
1601N/A static LogWriter vlog("Security");
1601N/A
1601N/A+#ifdef HAVE_GNUTLS
1601N/A+StringParameter Security::GnuTLSPriority("GnuTLSPriority",
1601N/A+ "GnuTLS priority string that controls the TLS session’s handshake algorithms",
1601N/A+ "NORMAL");
1601N/A+#endif
1601N/A+
1601N/A Security::Security(StringParameter &secTypes)
1601N/A {
1601N/A char *secTypesStr;
1601N/Adiff --git a/common/rfb/Security.h b/common/rfb/Security.h
1601N/Aindex 832735a..e69adf6 100644
1601N/A--- a/common/rfb/Security.h
1601N/A+++ b/common/rfb/Security.h
1601N/A@@ -93,6 +93,10 @@ namespace rfb {
1601N/A /* Output char* is stored in static array */
1601N/A char *ToString(void);
1601N/A
1601N/A+#ifdef HAVE_GNUTLS
1601N/A+ static StringParameter GnuTLSPriority;
1601N/A+#endif
1601N/A+
1601N/A private:
1601N/A std::list<rdr::U32> enabledSecTypes;
1601N/A };
1601N/Adiff --git a/configure.ac b/configure.ac
1601N/Aindex b0b6501..cf1ad6e 100644
1601N/A--- a/configure.ac
1601N/A+++ b/configure.ac
1601N/A@@ -100,6 +100,11 @@ if test "x$enable_gnutls" = xyes; then
1601N/A [GNUTLS_LIBS=${GNUTLS_LDFLAGS}
1601N/A AC_DEFINE(HAVE_GNUTLS, 1, [Is gnutls present? ])
1601N/A AC_MSG_RESULT(yes)], AC_MSG_RESULT(no))
1601N/A+ AC_MSG_CHECKING([for gnutls_transport_set_errno() function])
1601N/A+ AC_LINK_IFELSE(AC_LANG_CALL([], gnutls_transport_set_errno),
1601N/A+ AC_MSG_RESULT(yes),
1601N/A+ [AC_DEFINE(HAVE_GNUTLS_SET_ERRNO, 1, [Does gnutls have the gnutls_transport_set_errno() function? ])
1601N/A+ AC_MSG_RESULT(no)])
1601N/A AC_MSG_CHECKING([for gnutls_transport_set_global_errno() function])
1601N/A AC_LINK_IFELSE(AC_LANG_CALL([], gnutls_transport_set_global_errno),
1601N/A AC_MSG_RESULT(yes),