From dc75dd372225f29a200794c019f78f20f3f496a9 Mon Sep 17 00:00:00 2001 From: Remi Gacogne Date: Mon, 14 Feb 2022 17:43:11 +0100 Subject: [PATCH] dnsdist: Remove the leak warning with GnuTLS >= 3.7.3 --- pdns/tcpiohandler.cc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pdns/tcpiohandler.cc b/pdns/tcpiohandler.cc index 81fb4775df..8bdad5c0fc 100644 --- a/pdns/tcpiohandler.cc +++ b/pdns/tcpiohandler.cc @@ -1574,9 +1574,10 @@ public: if (params.d_validateCertificates) { if (params.d_caStore.empty()) { -#if GNUTLS_VERSION_NUMBER >= 0x030700 +#if GNUTLS_VERSION_NUMBER >= 0x030700 && GNUTLS_VERSION_NUMBER < 0x030703 + /* see https://gitlab.com/gnutls/gnutls/-/issues/1277 */ std::cerr<<"Warning: GnuTLS >= 3.7.0 has a known memory leak when validating server certificates in some configurations (PKCS11 support enabled, and a default PKCS11 trust store), please consider using the OpenSSL provider for outgoing connections instead, or explicitely setting a CA store"<= 0x030700 */ +#endif /* GNUTLS_VERSION_NUMBER >= 0x030700 && GNUTLS_VERSION_NUMBER < 0x030703 */ rc = gnutls_certificate_set_x509_system_trust(d_creds.get()); if (rc < 0) { throw std::runtime_error("Error adding the system's default trusted CAs: " + std::string(gnutls_strerror(rc))); -- 2.47.2