libvncclient: fix GnuTLS client-aware log scope

marcofortina · marcofortina · commit 2b11dfb8a5f5 · 2026-05-17T00:12:08.000Z
diff --git a/src/libvncclient/tls_gnutls.c b/src/libvncclient/tls_gnutls.c
@@ -92,21 +92,21 @@ verify_certificate_callback (gnutls_session_t session)
 
   TLSCallbackData *callback_data = (TLSCallbackData *)gnutls_session_get_ptr(session);
   if (!callback_data) {
-    rfbClientErrEx(client, "Failed to validate certificate - missing callback data\n");
+    rfbClientErr("Failed to validate certificate - missing callback data\n");
     return GNUTLS_E_CERTIFICATE_ERROR;
   }
 
   sptr = callback_data->rfbClient;
   cred = callback_data->rfbCredential;
 
   if (!sptr) {
-    rfbClientLogEx(client, "Failed to validate certificate - missing client data\n");
+    rfbClientLog("Failed to validate certificate - missing client data\n");
     return GNUTLS_E_CERTIFICATE_ERROR;
   }
 
   hostname = sptr->serverHost;
   if (!hostname) {
-      rfbClientLogEx(client, "No server hostname found for client\n");
+      rfbClientLogEx(sptr, "No server hostname found for client\n");
       return GNUTLS_E_CERTIFICATE_ERROR;
   }
 
@@ -116,49 +116,49 @@ verify_certificate_callback (gnutls_session_t session)
   ret = gnutls_certificate_verify_peers2 (session, &status);
   if (ret < 0)
     {
-      rfbClientLogEx(client, "Certificate validation call failed\n");
+      rfbClientLogEx(sptr, "Certificate validation call failed\n");
       return GNUTLS_E_CERTIFICATE_ERROR;
     }
 
   if (status & GNUTLS_CERT_INVALID)
-    rfbClientLogEx(client, "The certificate is not trusted.\n");
+    rfbClientLogEx(sptr, "The certificate is not trusted.\n");
 
   if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
-    rfbClientLogEx(client, "The certificate hasn't got a known issuer.\n");
+    rfbClientLogEx(sptr, "The certificate hasn't got a known issuer.\n");
 
   if (status & GNUTLS_CERT_REVOKED)
-    rfbClientLogEx(client, "The certificate has been revoked.\n");
+    rfbClientLogEx(sptr, "The certificate has been revoked.\n");
 
   if (status & GNUTLS_CERT_EXPIRED)
-    rfbClientLogEx(client, "The certificate has expired\n");
+    rfbClientLogEx(sptr, "The certificate has expired\n");
 
   if (status & GNUTLS_CERT_NOT_ACTIVATED)
-    rfbClientLogEx(client, "The certificate is not yet activated\n");
+    rfbClientLogEx(sptr, "The certificate is not yet activated\n");
 
   /* status would be 0 if cert was trusted */
   if (status)
   {
       if (gnutls_certificate_type_get (session) != GNUTLS_CRT_X509) {
-        rfbClientErrEx(client, "The certificate was not X509\n");
+        rfbClientErrEx(sptr, "The certificate was not X509\n");
         return GNUTLS_E_CERTIFICATE_ERROR;
       }
 
       if (gnutls_x509_crt_init (&cert) < 0)
         {
-          rfbClientErrEx(client, "Error initialising certificate structure\n");
+          rfbClientErrEx(sptr, "Error initialising certificate structure\n");
           return GNUTLS_E_CERTIFICATE_ERROR;
         }
 
       cert_list = gnutls_certificate_get_peers (session, &cert_list_size);
       if (cert_list == NULL)
         {
-          rfbClientErrEx(client, "No certificate was found!\n");
+          rfbClientErrEx(sptr, "No certificate was found!\n");
           return GNUTLS_E_CERTIFICATE_ERROR;
         }
 
       if (gnutls_x509_crt_import (cert, &cert_list[0], GNUTLS_X509_FMT_DER) < 0)
         {
-          rfbClientErrEx(client, "Error parsing certificate\n");
+          rfbClientErrEx(sptr, "Error parsing certificate\n");
           return GNUTLS_E_CERTIFICATE_ERROR;
         }
 
@@ -169,7 +169,7 @@ verify_certificate_callback (gnutls_session_t session)
 
           if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA256, remote_fingerprint, &fingerprint_size) == 0) {
               if (memcmp(remote_fingerprint, cred->x509Credential.x509ExpectedFingerprint, 32) == 0) {
-                  rfbClientLogEx(client, "The certificate's fingerprint matched the expected one - accepting.\n");
+                  rfbClientLogEx(sptr, "The certificate's fingerprint matched the expected one - accepting.\n");
                   gnutls_x509_crt_deinit (cert);
                   return 0;
               }
@@ -178,7 +178,7 @@ verify_certificate_callback (gnutls_session_t session)
 
       /* Fingerprint didn't match or no expected fingerprint - ask user */
       if (cert_fingerprint_mismatch_callback(sptr, cert)) {
-          rfbClientLogEx(client, "User decided to trust certificate - accepting.\n");
+          rfbClientLogEx(sptr, "User decided to trust certificate - accepting.\n");
           gnutls_x509_crt_deinit (cert);
           return 0;
       }
@@ -189,32 +189,32 @@ verify_certificate_callback (gnutls_session_t session)
 
   /* Certificate is trusted by system CA or via given rfbCredential.x509Credential.x509CACertfile  */
   if (gnutls_certificate_type_get (session) != GNUTLS_CRT_X509) {
-    rfbClientLogEx(client, "The certificate was not X509\n");
+    rfbClientLogEx(sptr, "The certificate was not X509\n");
     return GNUTLS_E_CERTIFICATE_ERROR;
   }
 
   if (gnutls_x509_crt_init (&cert) < 0)
     {
-      rfbClientLogEx(client, "Error initialising certificate structure\n");
+      rfbClientLogEx(sptr, "Error initialising certificate structure\n");
       return GNUTLS_E_CERTIFICATE_ERROR;
     }
 
   cert_list = gnutls_certificate_get_peers (session, &cert_list_size);
   if (cert_list == NULL)
     {
-      rfbClientLogEx(client, "No certificate was found!\n");
+      rfbClientLogEx(sptr, "No certificate was found!\n");
       return GNUTLS_E_CERTIFICATE_ERROR;
     }
 
   if (gnutls_x509_crt_import (cert, &cert_list[0], GNUTLS_X509_FMT_DER) < 0)
     {
-      rfbClientLogEx(client, "Error parsing certificate\n");
+      rfbClientLogEx(sptr, "Error parsing certificate\n");
       return GNUTLS_E_CERTIFICATE_ERROR;
     }
 
   if (!gnutls_x509_crt_check_hostname (cert, hostname))
     {
-      rfbClientLogEx(client, "The certificate's owner does not match hostname '%s'\n",
+      rfbClientLogEx(sptr, "The certificate's owner does not match hostname '%s'\n",
               hostname);
       return GNUTLS_E_CERTIFICATE_ERROR;
     }
@@ -235,10 +235,10 @@ InitializeTLS(void)
       (ret = gnutls_dh_params_init(&rfbDHParams)) < 0 ||
       (ret = gnutls_dh_params_generate2(rfbDHParams, DH_BITS)) < 0)
   {
-    rfbClientLogEx(client, "Failed to initialized GnuTLS: %s.\n", gnutls_strerror(ret));
+    rfbClientLog("Failed to initialized GnuTLS: %s.\n", gnutls_strerror(ret));
     return FALSE;
   }
-  rfbClientLogEx(client, "GnuTLS version %s initialized.\n", gnutls_check_version(NULL));
+  rfbClientLog("GnuTLS version %s initialized.\n", gnutls_check_version(NULL));
   rfbTLSInitialized = TRUE;
   return TRUE;
 }
@@ -512,49 +512,49 @@ CreateX509CertCredential(rfbCredential *cred)
 
   if ((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0)
   {
-    rfbClientLogEx(client, "Cannot allocate credentials: %s.\n", gnutls_strerror(ret));
+    rfbClientLog("Cannot allocate credentials: %s.\n", gnutls_strerror(ret));
     return NULL;
   }
   if (cred->x509Credential.x509CACertFile)
   {
       if ((ret = gnutls_certificate_set_x509_trust_file(x509_cred,
                                                         cred->x509Credential.x509CACertFile, GNUTLS_X509_FMT_PEM)) < 0)
           {
-              rfbClientLogEx(client, "Cannot load CA credentials: %s.\n", gnutls_strerror(ret));
+              rfbClientLog("Cannot load CA credentials: %s.\n", gnutls_strerror(ret));
               gnutls_certificate_free_credentials (x509_cred);
               return NULL;
           }
   } else
   {
       int certs = gnutls_certificate_set_x509_system_trust (x509_cred);
-      rfbClientLogEx(client, "Using default paths for certificate verification, %d certs found\n", certs);
+      rfbClientLog("Using default paths for certificate verification, %d certs found\n", certs);
   }
   if (cred->x509Credential.x509ClientCertFile && cred->x509Credential.x509ClientKeyFile)
   {
     if ((ret = gnutls_certificate_set_x509_key_file(x509_cred,
       cred->x509Credential.x509ClientCertFile, cred->x509Credential.x509ClientKeyFile,
       GNUTLS_X509_FMT_PEM)) < 0)
     {
-      rfbClientLogEx(client, "Cannot load client certificate or key: %s.\n", gnutls_strerror(ret));
+      rfbClientLog("Cannot load client certificate or key: %s.\n", gnutls_strerror(ret));
       gnutls_certificate_free_credentials (x509_cred);
       return NULL;
     }
   } else
   {
-    rfbClientLogEx(client, "No client certificate or key provided.\n");
+    rfbClientLog("No client certificate or key provided.\n");
   }
   if (cred->x509Credential.x509CACrlFile)
   {
     if ((ret = gnutls_certificate_set_x509_crl_file(x509_cred,
       cred->x509Credential.x509CACrlFile, GNUTLS_X509_FMT_PEM)) < 0)
     {
-      rfbClientLogEx(client, "Cannot load CRL: %s.\n", gnutls_strerror(ret));
+      rfbClientLog("Cannot load CRL: %s.\n", gnutls_strerror(ret));
       gnutls_certificate_free_credentials (x509_cred);
       return NULL;
     }
   } else
   {
-    rfbClientLogEx(client, "No CRL provided.\n");
+    rfbClientLog("No CRL provided.\n");
   }
   gnutls_certificate_set_dh_params (x509_cred, rfbDHParams);
   return x509_cred;

Original file line number	Diff line number	Diff line change
`@@ -92,21 +92,21 @@ verify_certificate_callback (gnutls_session_t session)`
`92`	`92`
`93`	`93`	`TLSCallbackData callback_data = (TLSCallbackData )gnutls_session_get_ptr(session);`
`94`	`94`	`if (!callback_data) {`
`95`		`- rfbClientErrEx(client, "Failed to validate certificate - missing callback data\n");`
	`95`	`+ rfbClientErr("Failed to validate certificate - missing callback data\n");`
`96`	`96`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`97`	`97`	`}`
`98`	`98`
`99`	`99`	`sptr = callback_data->rfbClient;`
`100`	`100`	`cred = callback_data->rfbCredential;`
`101`	`101`
`102`	`102`	`if (!sptr) {`
`103`		`- rfbClientLogEx(client, "Failed to validate certificate - missing client data\n");`
	`103`	`+ rfbClientLog("Failed to validate certificate - missing client data\n");`
`104`	`104`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`105`	`105`	`}`
`106`	`106`
`107`	`107`	`hostname = sptr->serverHost;`
`108`	`108`	`if (!hostname) {`
`109`		`- rfbClientLogEx(client, "No server hostname found for client\n");`
	`109`	`+ rfbClientLogEx(sptr, "No server hostname found for client\n");`
`110`	`110`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`111`	`111`	`}`
`112`	`112`
`@@ -116,49 +116,49 @@ verify_certificate_callback (gnutls_session_t session)`
`116`	`116`	`ret = gnutls_certificate_verify_peers2 (session, &status);`
`117`	`117`	`if (ret < 0)`
`118`	`118`	`{`
`119`		`- rfbClientLogEx(client, "Certificate validation call failed\n");`
	`119`	`+ rfbClientLogEx(sptr, "Certificate validation call failed\n");`
`120`	`120`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`121`	`121`	`}`
`122`	`122`
`123`	`123`	`if (status & GNUTLS_CERT_INVALID)`
`124`		`- rfbClientLogEx(client, "The certificate is not trusted.\n");`
	`124`	`+ rfbClientLogEx(sptr, "The certificate is not trusted.\n");`
`125`	`125`
`126`	`126`	`if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)`
`127`		`- rfbClientLogEx(client, "The certificate hasn't got a known issuer.\n");`
	`127`	`+ rfbClientLogEx(sptr, "The certificate hasn't got a known issuer.\n");`
`128`	`128`
`129`	`129`	`if (status & GNUTLS_CERT_REVOKED)`
`130`		`- rfbClientLogEx(client, "The certificate has been revoked.\n");`
	`130`	`+ rfbClientLogEx(sptr, "The certificate has been revoked.\n");`
`131`	`131`
`132`	`132`	`if (status & GNUTLS_CERT_EXPIRED)`
`133`		`- rfbClientLogEx(client, "The certificate has expired\n");`
	`133`	`+ rfbClientLogEx(sptr, "The certificate has expired\n");`
`134`	`134`
`135`	`135`	`if (status & GNUTLS_CERT_NOT_ACTIVATED)`
`136`		`- rfbClientLogEx(client, "The certificate is not yet activated\n");`
	`136`	`+ rfbClientLogEx(sptr, "The certificate is not yet activated\n");`
`137`	`137`
`138`	`138`	`/* status would be 0 if cert was trusted */`
`139`	`139`	`if (status)`
`140`	`140`	`{`
`141`	`141`	`if (gnutls_certificate_type_get (session) != GNUTLS_CRT_X509) {`
`142`		`- rfbClientErrEx(client, "The certificate was not X509\n");`
	`142`	`+ rfbClientErrEx(sptr, "The certificate was not X509\n");`
`143`	`143`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`144`	`144`	`}`
`145`	`145`
`146`	`146`	`if (gnutls_x509_crt_init (&cert) < 0)`
`147`	`147`	`{`
`148`		`- rfbClientErrEx(client, "Error initialising certificate structure\n");`
	`148`	`+ rfbClientErrEx(sptr, "Error initialising certificate structure\n");`
`149`	`149`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`150`	`150`	`}`
`151`	`151`
`152`	`152`	`cert_list = gnutls_certificate_get_peers (session, &cert_list_size);`
`153`	`153`	`if (cert_list == NULL)`
`154`	`154`	`{`
`155`		`- rfbClientErrEx(client, "No certificate was found!\n");`
	`155`	`+ rfbClientErrEx(sptr, "No certificate was found!\n");`
`156`	`156`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`157`	`157`	`}`
`158`	`158`
`159`	`159`	`if (gnutls_x509_crt_import (cert, &cert_list[0], GNUTLS_X509_FMT_DER) < 0)`
`160`	`160`	`{`
`161`		`- rfbClientErrEx(client, "Error parsing certificate\n");`
	`161`	`+ rfbClientErrEx(sptr, "Error parsing certificate\n");`
`162`	`162`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`163`	`163`	`}`
`164`	`164`
`@@ -169,7 +169,7 @@ verify_certificate_callback (gnutls_session_t session)`
`169`	`169`
`170`	`170`	`if (gnutls_x509_crt_get_fingerprint(cert, GNUTLS_DIG_SHA256, remote_fingerprint, &fingerprint_size) == 0) {`
`171`	`171`	`if (memcmp(remote_fingerprint, cred->x509Credential.x509ExpectedFingerprint, 32) == 0) {`
`172`		`- rfbClientLogEx(client, "The certificate's fingerprint matched the expected one - accepting.\n");`
	`172`	`+ rfbClientLogEx(sptr, "The certificate's fingerprint matched the expected one - accepting.\n");`
`173`	`173`	`gnutls_x509_crt_deinit (cert);`
`174`	`174`	`return 0;`
`175`	`175`	`}`
`@@ -178,7 +178,7 @@ verify_certificate_callback (gnutls_session_t session)`
`178`	`178`
`179`	`179`	`/* Fingerprint didn't match or no expected fingerprint - ask user */`
`180`	`180`	`if (cert_fingerprint_mismatch_callback(sptr, cert)) {`
`181`		`- rfbClientLogEx(client, "User decided to trust certificate - accepting.\n");`
	`181`	`+ rfbClientLogEx(sptr, "User decided to trust certificate - accepting.\n");`
`182`	`182`	`gnutls_x509_crt_deinit (cert);`
`183`	`183`	`return 0;`
`184`	`184`	`}`
`@@ -189,32 +189,32 @@ verify_certificate_callback (gnutls_session_t session)`
`189`	`189`
`190`	`190`	`/* Certificate is trusted by system CA or via given rfbCredential.x509Credential.x509CACertfile */`
`191`	`191`	`if (gnutls_certificate_type_get (session) != GNUTLS_CRT_X509) {`
`192`		`- rfbClientLogEx(client, "The certificate was not X509\n");`
	`192`	`+ rfbClientLogEx(sptr, "The certificate was not X509\n");`
`193`	`193`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`194`	`194`	`}`
`195`	`195`
`196`	`196`	`if (gnutls_x509_crt_init (&cert) < 0)`
`197`	`197`	`{`
`198`		`- rfbClientLogEx(client, "Error initialising certificate structure\n");`
	`198`	`+ rfbClientLogEx(sptr, "Error initialising certificate structure\n");`
`199`	`199`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`200`	`200`	`}`
`201`	`201`
`202`	`202`	`cert_list = gnutls_certificate_get_peers (session, &cert_list_size);`
`203`	`203`	`if (cert_list == NULL)`
`204`	`204`	`{`
`205`		`- rfbClientLogEx(client, "No certificate was found!\n");`
	`205`	`+ rfbClientLogEx(sptr, "No certificate was found!\n");`
`206`	`206`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`207`	`207`	`}`
`208`	`208`
`209`	`209`	`if (gnutls_x509_crt_import (cert, &cert_list[0], GNUTLS_X509_FMT_DER) < 0)`
`210`	`210`	`{`
`211`		`- rfbClientLogEx(client, "Error parsing certificate\n");`
	`211`	`+ rfbClientLogEx(sptr, "Error parsing certificate\n");`
`212`	`212`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`213`	`213`	`}`
`214`	`214`
`215`	`215`	`if (!gnutls_x509_crt_check_hostname (cert, hostname))`
`216`	`216`	`{`
`217`		`- rfbClientLogEx(client, "The certificate's owner does not match hostname '%s'\n",`
	`217`	`+ rfbClientLogEx(sptr, "The certificate's owner does not match hostname '%s'\n",`
`218`	`218`	`hostname);`
`219`	`219`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`220`	`220`	`}`
`@@ -235,10 +235,10 @@ InitializeTLS(void)`
`235`	`235`	`(ret = gnutls_dh_params_init(&rfbDHParams)) < 0 \|\|`
`236`	`236`	`(ret = gnutls_dh_params_generate2(rfbDHParams, DH_BITS)) < 0)`
`237`	`237`	`{`
`238`		`- rfbClientLogEx(client, "Failed to initialized GnuTLS: %s.\n", gnutls_strerror(ret));`
	`238`	`+ rfbClientLog("Failed to initialized GnuTLS: %s.\n", gnutls_strerror(ret));`
`239`	`239`	`return FALSE;`
`240`	`240`	`}`
`241`		`- rfbClientLogEx(client, "GnuTLS version %s initialized.\n", gnutls_check_version(NULL));`
	`241`	`+ rfbClientLog("GnuTLS version %s initialized.\n", gnutls_check_version(NULL));`
`242`	`242`	`rfbTLSInitialized = TRUE;`
`243`	`243`	`return TRUE;`
`244`	`244`	`}`
`@@ -512,49 +512,49 @@ CreateX509CertCredential(rfbCredential *cred)`
`512`	`512`
`513`	`513`	`if ((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0)`
`514`	`514`	`{`
`515`		`- rfbClientLogEx(client, "Cannot allocate credentials: %s.\n", gnutls_strerror(ret));`
	`515`	`+ rfbClientLog("Cannot allocate credentials: %s.\n", gnutls_strerror(ret));`
`516`	`516`	`return NULL;`
`517`	`517`	`}`
`518`	`518`	`if (cred->x509Credential.x509CACertFile)`
`519`	`519`	`{`
`520`	`520`	`if ((ret = gnutls_certificate_set_x509_trust_file(x509_cred,`
`521`	`521`	`cred->x509Credential.x509CACertFile, GNUTLS_X509_FMT_PEM)) < 0)`
`522`	`522`	`{`
`523`		`- rfbClientLogEx(client, "Cannot load CA credentials: %s.\n", gnutls_strerror(ret));`
	`523`	`+ rfbClientLog("Cannot load CA credentials: %s.\n", gnutls_strerror(ret));`
`524`	`524`	`gnutls_certificate_free_credentials (x509_cred);`
`525`	`525`	`return NULL;`
`526`	`526`	`}`
`527`	`527`	`} else`
`528`	`528`	`{`
`529`	`529`	`int certs = gnutls_certificate_set_x509_system_trust (x509_cred);`
`530`		`- rfbClientLogEx(client, "Using default paths for certificate verification, %d certs found\n", certs);`
	`530`	`+ rfbClientLog("Using default paths for certificate verification, %d certs found\n", certs);`
`531`	`531`	`}`
`532`	`532`	`if (cred->x509Credential.x509ClientCertFile && cred->x509Credential.x509ClientKeyFile)`
`533`	`533`	`{`
`534`	`534`	`if ((ret = gnutls_certificate_set_x509_key_file(x509_cred,`
`535`	`535`	`cred->x509Credential.x509ClientCertFile, cred->x509Credential.x509ClientKeyFile,`
`536`	`536`	`GNUTLS_X509_FMT_PEM)) < 0)`
`537`	`537`	`{`
`538`		`- rfbClientLogEx(client, "Cannot load client certificate or key: %s.\n", gnutls_strerror(ret));`
	`538`	`+ rfbClientLog("Cannot load client certificate or key: %s.\n", gnutls_strerror(ret));`
`539`	`539`	`gnutls_certificate_free_credentials (x509_cred);`
`540`	`540`	`return NULL;`
`541`	`541`	`}`
`542`	`542`	`} else`
`543`	`543`	`{`
`544`		`- rfbClientLogEx(client, "No client certificate or key provided.\n");`
	`544`	`+ rfbClientLog("No client certificate or key provided.\n");`
`545`	`545`	`}`
`546`	`546`	`if (cred->x509Credential.x509CACrlFile)`
`547`	`547`	`{`
`548`	`548`	`if ((ret = gnutls_certificate_set_x509_crl_file(x509_cred,`
`549`	`549`	`cred->x509Credential.x509CACrlFile, GNUTLS_X509_FMT_PEM)) < 0)`
`550`	`550`	`{`
`551`		`- rfbClientLogEx(client, "Cannot load CRL: %s.\n", gnutls_strerror(ret));`
	`551`	`+ rfbClientLog("Cannot load CRL: %s.\n", gnutls_strerror(ret));`
`552`	`552`	`gnutls_certificate_free_credentials (x509_cred);`
`553`	`553`	`return NULL;`
`554`	`554`	`}`
`555`	`555`	`} else`
`556`	`556`	`{`
`557`		`- rfbClientLogEx(client, "No CRL provided.\n");`
	`557`	`+ rfbClientLog("No CRL provided.\n");`
`558`	`558`	`}`
`559`	`559`	`gnutls_certificate_set_dh_params (x509_cred, rfbDHParams);`
`560`	`560`	`return x509_cred;`