use builtin dh_params with newer gnutls

[vncterm.git] / vncterm.c

diff --git a/vncterm.c b/vncterm.c
index 9d74bf669d8b4ad282e8be2f4c46b503c8b2cd7b..0614e4b2df9531d169f2d90cfc6d636ae1654bb8 100644 (file)
--- a/vncterm.c
+++ b/vncterm.c
@@ -169,7 +169,7 @@ static void vnc_debug_gnutls_log(int level, const char* str) {
 }
 #endif
 
-#define DH_BITS 1024
+#define DH_BITS 2048
 static gnutls_dh_params_t dh_params;
 
 typedef struct {
@@ -256,7 +256,11 @@ tls_initialize_anon_cred(void)
                return NULL;
        }
 
+#if GNUTLS_VERSION_NUMBER >= 0x030506
+       gnutls_anon_set_server_known_dh_params(anon_cred, GNUTLS_SEC_PARAM_MEDIUM);
+#else
        gnutls_anon_set_server_dh_params(anon_cred, dh_params);
+#endif
 
        return anon_cred;
 }
@@ -290,8 +294,13 @@ tls_initialize_x509_cred(void)
                gnutls_certificate_free_credentials(x509_cred);
                return NULL;
        }
-
+#if GNUTLS_VERSION_NUMBER >= 0x030506
+       /* only available since GnuTLS 3.5.6, on previous versions see
+        * gnutls_certificate_set_dh_params(). */
+       gnutls_certificate_set_known_dh_params(x509_cred, GNUTLS_SEC_PARAM_MEDIUM);
+#else
        gnutls_certificate_set_dh_params (x509_cred, dh_params);
+#endif
 
        return x509_cred;
 }
@@ -2334,27 +2343,26 @@ main (int argc, char** argv)
     if (!strcmp (argv[i], "-timeout")) {
       CHECK_ARGC (argc, argv, i);
       idle_timeout = atoi(argv[i+1]);
-      rfbPurgeArguments(&argc, &i, 2, argv);
-    }
-    if (!strcmp (argv[i], "-authpath")) {
+      rfbPurgeArguments(&argc, &i, 2, argv); i--;
+    } else if (!strcmp (argv[i], "-authpath")) {
       CHECK_ARGC (argc, argv, i);
       auth_path = argv[i+1];
-      rfbPurgeArguments(&argc, &i, 2, argv);
-    }
-    if (!strcmp (argv[i], "-perm")) {
+      rfbPurgeArguments(&argc, &i, 2, argv); i--;
+    } else if (!strcmp (argv[i], "-perm")) {
       CHECK_ARGC (argc, argv, i);
       auth_perm = argv[i+1];
-      rfbPurgeArguments(&argc, &i, 2, argv);
-    }
-    if (!strcmp (argv[i], "-notls")) {
-        rfbPurgeArguments(&argc, &i, 1, argv);
+      rfbPurgeArguments(&argc, &i, 2, argv); i--;
+    } else if (!strcmp (argv[i], "-notls")) {
+        rfbPurgeArguments(&argc, &i, 1, argv); i--;
         if ((vncticket = getenv("PVE_VNC_TICKET")) == NULL) {
-         fprintf(stderr, "missing env PVE_VNC_TICKET (-notls)\n");
+          fprintf(stderr, "missing env PVE_VNC_TICKET (-notls)\n");
          exit(-1);           
         }
     }
   }
 
+  unsetenv("PVE_VNC_TICKET"); // do not expose this to child
+
 #ifdef DEBUG
   rfbLogEnable (1);
   gnutls_global_set_log_level(10);