[PATCH v2 1/3] bcrypt: Prevent gnutls from using system priority file.

[Paul Gofman]

Fedora 33 disabled protocols below TLS 1.2 through crypto policy [1].

https://fedoraproject.org/wiki/Changes/StrongCryptoSettings2#Strong_crypto_s...
Signed-off-by: Paul Gofman <pgofman(a)codeweavers.com>
---
v2:
    - print warning.

 dlls/bcrypt/gnutls.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/dlls/bcrypt/gnutls.c b/dlls/bcrypt/gnutls.c
index e85085499ca..41df88ca8f6 100644
--- a/dlls/bcrypt/gnutls.c
+++ b/dlls/bcrypt/gnutls.c
@@ -222,8 +222,19 @@ static void gnutls_log( int level, const char *msg )
 
 static BOOL gnutls_initialize(void)
 {
+    const char *env_str;
     int ret;
 
+    if ((env_str = getenv("GNUTLS_SYSTEM_PRIORITY_FILE")))
+    {
+        WARN("GNUTLS_SYSTEM_PRIORITY_FILE is %s.\n", debugstr_a(env_str));
+    }
+    else
+    {
+        WARN("Setting GNUTLS_SYSTEM_PRIORITY_FILE to \"/dev/null\".\n");
+        setenv("GNUTLS_SYSTEM_PRIORITY_FILE", "/dev/null", 0);
+    }
+
     if (!(libgnutls_handle = dlopen( SONAME_LIBGNUTLS, RTLD_NOW )))
     {
         ERR_(winediag)( "failed to load libgnutls, no support for encryption\n" );
-- 
2.28.0

[PATCH v2 2/3] crypt32: Prevent gnutls from using system priority file.

[Paul Gofman]

Signed-off-by: Paul Gofman <pgofman(a)codeweavers.com>
---
v2:
    - print warning.

 dlls/crypt32/unixlib.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/dlls/crypt32/unixlib.c b/dlls/crypt32/unixlib.c
index 47be5691005..035f2d936bb 100644
--- a/dlls/crypt32/unixlib.c
+++ b/dlls/crypt32/unixlib.c
@@ -86,8 +86,19 @@ static void gnutls_log( int level, const char *msg )
 
 BOOL gnutls_initialize(void)
 {
+    const char *env_str;
     int ret;
 
+    if ((env_str = getenv("GNUTLS_SYSTEM_PRIORITY_FILE")))
+    {
+        WARN("GNUTLS_SYSTEM_PRIORITY_FILE is %s.\n", debugstr_a(env_str));
+    }
+    else
+    {
+        WARN("Setting GNUTLS_SYSTEM_PRIORITY_FILE to \"/dev/null\".\n");
+        setenv("GNUTLS_SYSTEM_PRIORITY_FILE", "/dev/null", 0);
+    }
+
     if (!(libgnutls_handle = dlopen( SONAME_LIBGNUTLS, RTLD_NOW )))
     {
         ERR_(winediag)( "failed to load libgnutls, no support for pfx import/export\n" );
-- 
2.28.0

[PATCH v2 3/3] secur32: Prevent gnutls from using system priority file.

[Paul Gofman]

Signed-off-by: Paul Gofman <pgofman(a)codeweavers.com>
---
v2:
    - print warning.

 dlls/secur32/schannel_gnutls.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/dlls/secur32/schannel_gnutls.c b/dlls/secur32/schannel_gnutls.c
index c4a36a899a0..784c1ffe6e8 100644
--- a/dlls/secur32/schannel_gnutls.c
+++ b/dlls/secur32/schannel_gnutls.c
@@ -977,8 +977,19 @@ static void schan_gnutls_log(int level, const char *msg)
 
 BOOL schan_imp_init(void)
 {
+    const char *env_str;
     int ret;
 
+    if ((env_str = getenv("GNUTLS_SYSTEM_PRIORITY_FILE")))
+    {
+        WARN("GNUTLS_SYSTEM_PRIORITY_FILE is %s.\n", debugstr_a(env_str));
+    }
+    else
+    {
+        WARN("Setting GNUTLS_SYSTEM_PRIORITY_FILE to \"/dev/null\".\n");
+        setenv("GNUTLS_SYSTEM_PRIORITY_FILE", "/dev/null", 0);
+    }
+
     libgnutls_handle = dlopen(SONAME_LIBGNUTLS, RTLD_NOW);
     if (!libgnutls_handle)
     {
-- 
2.28.0

[Marvin]

Hi,

While running your changed tests, I think I found new failures.
Being a bot and all I'm not very good at pattern recognition, so I might be
wrong, but could you please double-check?

Full results can be found at:
https://testbot.winehq.org/JobDetails.pl?Key=81737

Your paranoid android.


=== debiant (32 bit Chinese:China report) ===

bcrypt:
bcrypt.c:2346: Test failed: got c000a000

[Hans Leidekker]

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com>