A year or so ago we introduced a workaround for a troubling GNUTLS
thread safety problem that hits when a bidirectional TLS channel
is used and "large" amounts of data are transferred triggering
re-keying under TLS 1.3.
Unfortunately that workaround turned out to not work, and since it
was close to final freeze we disabled it, rather than attempt last
minute changes.
Fast forward a year, and GNUTLS has shipped a fix itself and RHEL
at least has backported the fix to stable releases. A user who
is still affected can workaround it by disabling TLS 1.3, or
forcing use of a different cipher to avoid re-keying entirely.
Getting a viable workaround operating correctly in QEMU is going
to be challenging and fragile long term, so not worth spending
more time on.
Revert the broken workaround (which was already hardcoded to be
disabled at build time).
Daniel P. Berrangé (4):
Revert "migration: activate TLS thread safety workaround"
Revert "io: add support for activating TLS thread safety workaround"
Revert "crypto: add tracing & warning about GNUTLS countermeasures"
Revert "crypto: implement workaround for GNUTLS thread safety
problems"
crypto/tlssession.c | 103 ++----------------------------------
crypto/trace-events | 1 -
include/crypto/tlssession.h | 14 -----
include/io/channel.h | 1 -
io/channel-tls.c | 5 --
meson.build | 9 ----
migration/tls.c | 9 ----
7 files changed, 3 insertions(+), 139 deletions(-)
--
2.56.0
