This reverts commit 0db6f798024ea6f57ecf2020209b761b50a01d71. The workaround for the GNUTLS bug was not correct and it was decided to rely on GNUTLS being patched by distros instead, or users manually disabling use of the problematic ciphers.
Signed-off-by: Daniel P. Berrangé <[email protected]> --- crypto/tlssession.c | 11 ----------- crypto/trace-events | 1 - 2 files changed, 12 deletions(-) diff --git a/crypto/tlssession.c b/crypto/tlssession.c index b343d1a5956..9450c83d9c3 100644 --- a/crypto/tlssession.c +++ b/crypto/tlssession.c @@ -19,7 +19,6 @@ */ #include "qemu/osdep.h" -#include "qemu/error-report.h" #include "qemu/thread.h" #include "crypto/tlssession.h" #include "crypto/tlscredsanon.h" @@ -572,20 +571,10 @@ qcrypto_tls_session_handshake(QCryptoTLSSession *session, * only have to protect against automatic rekeying * which doesn't trigger with CHACHA20 */ - trace_qcrypto_tls_session_parameters( - session, - session->requireThreadSafety, - gnutls_protocol_get_version(session->handle), - cipher); - if (session->requireThreadSafety && gnutls_protocol_get_version(session->handle) == GNUTLS_TLS1_3 && cipher != GNUTLS_CIPHER_CHACHA20_POLY1305) { - warn_report("WARNING: activating thread safety countermeasures " - "for potentially broken GNUTLS with TLS1.3 cipher=%d", - cipher); - trace_qcrypto_tls_session_bug1717_workaround(session); session->lockEnabled = true; } #endif diff --git a/crypto/trace-events b/crypto/trace-events index 771f9b8a6e8..9905ea261a9 100644 --- a/crypto/trace-events +++ b/crypto/trace-events @@ -23,7 +23,6 @@ qcrypto_tls_session_new(void *session, void *creds, const char *hostname, const qcrypto_tls_session_check_creds(void *session, const char *status) "TLS session check creds session=%p status=%s" qcrypto_tls_session_check_x509_dn(void *session, const char *dname) "TLS session check x509 distinguished name session=%p dname=%s" qcrypto_tls_session_parameters(void *session, int threadSafety, int protocol, int cipher) "TLS session parameters session=%p threadSafety=%d protocol=%d cipher=%d" -qcrypto_tls_session_bug1717_workaround(void *session) "TLS session bug1717 workaround session=%p" # tls-cipher-suites.c qcrypto_tls_cipher_suite_priority(const char *name) "priority: %s" -- 2.56.0
