diff options
| author | Iwan Timmer <irtimmer@gmail.com> | 2019-10-29 20:26:05 +0100 |
|---|---|---|
| committer | Iwan Timmer <irtimmer@gmail.com> | 2019-10-29 20:26:05 +0100 |
| commit | 38e053c58fa139e0f546f327b5d8ce3db7cf1647 (patch) | |
| tree | 20e4b34d657ddb86b192cb801894f78b3cca621a | |
| parent | 644ee2546102f9aa12b11c28b3c5e80b62beb157 (diff) | |
| download | systemd-38e053c58fa139e0f546f327b5d8ce3db7cf1647.tar.gz | |
resolved: require at least version 3.6.0 of GnuTLS for DNS-over-TLS
Increase the required version to ensure TLS 1.3 is always supported when using GnuTLS for DNS-over-TLS and allow further changes to use recent API additions.
| -rw-r--r-- | README | 2 | ||||
| -rw-r--r-- | meson.build | 2 | ||||
| -rw-r--r-- | src/resolve/resolved-dnstls-gnutls.c | 4 |
3 files changed, 2 insertions, 6 deletions
@@ -155,7 +155,7 @@ REQUIREMENTS: libmicrohttpd (optional) libpython (optional) libidn2 or libidn (optional) - gnutls >= 3.1.4 (optional, >= 3.5.3 is required to support DNS-over-TLS with gnutls) + gnutls >= 3.1.4 (optional, >= 3.6.0 is required to support DNS-over-TLS with gnutls) openssl >= 1.1.0 (optional, required to support DNS-over-TLS with openssl) elfutils >= 158 (optional) polkit (optional) diff --git a/meson.build b/meson.build index 0001504d53..a7a9222582 100644 --- a/meson.build +++ b/meson.build @@ -1199,7 +1199,7 @@ if dns_over_tls != 'false' if dns_over_tls == 'openssl' have_gnutls = false else - have_gnutls = (conf.get('HAVE_GNUTLS') == 1 and libgnutls.version().version_compare('>= 3.5.3')) + have_gnutls = (conf.get('HAVE_GNUTLS') == 1 and libgnutls.version().version_compare('>= 3.6.0')) if dns_over_tls == 'gnutls' and not have_gnutls error('DNS-over-TLS support was requested with gnutls, but dependencies are not available') endif diff --git a/src/resolve/resolved-dnstls-gnutls.c b/src/resolve/resolved-dnstls-gnutls.c index 7ad9662073..ea276d2c20 100644 --- a/src/resolve/resolved-dnstls-gnutls.c +++ b/src/resolve/resolved-dnstls-gnutls.c @@ -9,11 +9,7 @@ #include "resolved-dns-stream.h" #include "resolved-dnstls.h" -#if GNUTLS_VERSION_NUMBER >= 0x030600 #define PRIORTY_STRING "NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2" -#else -#define PRIORTY_STRING "NORMAL:-VERS-ALL:+VERS-TLS1.2" -#endif DEFINE_TRIVIAL_CLEANUP_FUNC(gnutls_session_t, gnutls_deinit); static ssize_t dnstls_stream_writev(gnutls_transport_ptr_t p, const giovec_t *iov, int iovcnt) { |