Re: TLS support: gnutls and/or openssl

On 10/29/18 12:27 PM, Petri Hintukainen wrote:
> ma, 2018-10-29 kello 11:29 +0100, Xavier Bachelot kirjoitti:
>> Hi,
>>
>> I have been using xine-lib snapshot lately and have enabled TLS
>> support
>> by adding the devel headers for both gnutls and openssl. Both
>> xineplug_tls_gnutls.so and xineplug_tls_openssl.so are then compiled.
>> However, I'm wondering if one is preferred over the other ?
> 
> by default, gnutls has higher priority:
> 
> tls/tls_gnutls.c:   .priority = 10,
> tls/tls_openssl.c:  .priority = 5,
> 
> so gnutls is used unless it fails to load.
> 
> 
> I don't know which one should be preferred, I guess it is up to distro
> policy ... ? One could ex. select the one with better performance on
> the hardware / arch used. Or the one with smaller binary size. Or the
> one with more suitable license.
> 
> Having support for both allows faster response to possible security
> issues in underlying tls implementations; one can just push updated
> packeges without "broken" plugin.
> 
> With my limited knowledge I'd prefer gnutls. There used to be license
> issues with OpenSSL, but I don't know if those exist anymore. Or how to
> handle those with least effort ... Maybe adding an exception to tls
> plugin license would be enough (loader interface is "generic" and
> plugins can be distributed separately).
> 
>> Is it wise
>> to have both built and shipped at the same time ?
> 
> You need only one, but having both makes no harm.
> 
> It adds ~100kb to install size, but there shouldn't be any measurable
> runtime performance impact.
> 

Thanks for the detailed answer, that is exactly what I expected. Well, 
actually, much more than what I expected :-)

Regards,
Xavier