From a6ef11572ffdfde69c901c8c4903c911f0e27d76 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 31 Jan 2018 11:09:38 +0000 Subject: [PATCH] Don't short-circuit request for TLS credentials MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Although newer GNUTLS has a default system trust fallback for CA certificates, we must still request certificates from the client app. If we do not, then the VNC client will never be given the opportunity to provide custom certs to override the system trust database. Signed-off-by: Daniel P. Berrangé (cherry picked from commit df656c79467c2595b4a2cd35283c7f5d52adf336) --- src/vncconnection.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/src/vncconnection.c b/src/vncconnection.c index 1ddf38d..e5496ef 100644 --- a/src/vncconnection.c +++ b/src/vncconnection.c @@ -3528,16 +3528,8 @@ static gboolean vnc_connection_has_credentials(gpointer data) return FALSE; if (priv->want_cred_password && !priv->cred_password) return FALSE; - /* - * For x509 we require a minimum of the CA cert - * if using GNUTLS < 3.0. With newer GNUTLS we'll - * fallback to the system trust, so don't need to - * explicitly check for a CA cert. - */ -#if GNUTLS_VERSION_NUMBER < 0x030000 if (priv->want_cred_x509 && !priv->cred_x509_cacert) return FALSE; -#endif return TRUE; }