Commit 25c37b3f authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont
Browse files

- Fix GnuTLS version detection

parent ef235f26
......@@ -1273,8 +1273,8 @@ AS_IF([test "${enable_gnutls}" != "no"], [
AC_CHECK_HEADER(gcrypt.h,
[AC_CHECK_LIB(gcrypt, gcry_control,
[AC_CHECK_HEADER(gnutls/gnutls.h,
[AC_CHECK_LIB(gnutls, gnutls_deinit,
[have_gnutls="yes"],, ${gnutls_LIBS})])],,
[AC_CHECK_LIB(gnutls, gnutls_certificate_verify_peers2,
[have_gnutls="yes"],[old_gnutls="yes"], ${gnutls_LIBS})])],,
${gcrypt_LIBS})])
AS_IF([test "${have_gnutls}" = "yes"], [
......@@ -1282,7 +1282,7 @@ AS_IF([test "${enable_gnutls}" != "no"], [
VLC_ADD_LDFLAGS([gnutls], [-lgnutls -lgcrypt -lgpg-error])
], [
AS_IF([test "${enable_gnutls}" = "yes"], [
AC_MSG_ERROR([gnutls/gcrypt TLS/SSL support cannot be compiled])]
AC_MSG_ERROR([gnutls not present or too old (version 1.0.17 required)])]
)]
)]
)
......
......@@ -65,6 +65,14 @@ static void Close( vlc_object_t * );
"Allows you to modify the maximum number of resumed TLS sessions that " \
"the cache will hold." )
#define CHECK_CERT_TEXT N_("Check TLS/SSL server certificate validity")
#define CHECK_CERT_LONGTEXT N_( \
"Ensures that server certificate is valid " \
"(ie. signed by an approved Certificate Authority)." )
#define CHECK_HOSTNAME_TEXT N_("Check TLS/SSL server hostname in certificate")
#define CHECK_HOSTNAME_LONGTEXT N_( \
"Ensures that server hostname in certificate match requested host name." )
vlc_module_begin();
set_description( _("GnuTLS TLS encryption layer") );
......@@ -73,6 +81,13 @@ vlc_module_begin();
set_category( CAT_ADVANCED );
set_subcategory( SUBCAT_ADVANCED_MISC );
#if 0
add_bool( "tls-check-cert", VLC_FALSE, NULL, CHECK_CERT_TEXT,
CHECK_CERT_LONGTEXT, VLC_FALSE );
add_bool( "tls-check-hostname", VLC_FALSE, NULL, CHECK_HOSTNAME_TEXT,
CHECK_HOSTNAME_LONGTEXT, VLC_FALSE );
#endif
add_integer( "dh-bits", DH_BITS, NULL, DH_BITS_TEXT,
DH_BITS_LONGTEXT, VLC_TRUE );
add_integer( "tls-cache-expiration", CACHE_EXPIRATION, NULL,
......@@ -865,6 +880,8 @@ Open( vlc_object_t *p_this )
if( count.i_int == 0)
{
const char *psz_version;
__p_gcry_data = VLC_OBJECT( p_this->p_vlc );
gcry_control (GCRYCTL_SET_THREAD_CBS, &gcry_threads_vlc);
......@@ -874,14 +891,19 @@ Open( vlc_object_t *p_this )
vlc_mutex_unlock( lock.p_address );
return VLC_EGENERIC;
}
if( gnutls_check_version( "1.0.0" ) == NULL )
/*
* FIXME: in fact, we currently depends on 1.0.17, but it breaks on
* Debian which as a patched 1.0.16 (which we can use).
*/
psz_version = gnutls_check_version( "1.0.16" );
if( psz_version == NULL )
{
gnutls_global_deinit( );
vlc_mutex_unlock( lock.p_address );
msg_Err( p_this, "unsupported GnuTLS version" );
return VLC_EGENERIC;
}
msg_Dbg( p_this, "GnuTLS initialized" );
msg_Dbg( p_this, "GnuTLS v%s initialized", psz_version );
}
count.i_int++;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment