On Tue, Oct 13, 2026 at 02:36:18PM +0100, Daniel P. Berrangé wrote: > A year or so ago we introduced a workaround for a troubling GNUTLS > thread safety problem that hits when a bidirectional TLS channel > is used and "large" amounts of data are transferred triggering > re-keying under TLS 1.3. > > Unfortunately that workaround turned out to not work, and since it > was close to final freeze we disabled it, rather than attempt last > minute changes. > > Fast forward a year, and GNUTLS has shipped a fix itself and RHEL > at least has backported the fix to stable releases. A user who > is still affected can workaround it by disabling TLS 1.3, or > forcing use of a different cipher to avoid re-keying entirely. > > Getting a viable workaround operating correctly in QEMU is going > to be challenging and fragile long term, so not worth spending > more time on. > > Revert the broken workaround (which was already hardcoded to be > disabled at build time). > > Daniel P. Berrangé (4): > Revert "migration: activate TLS thread safety workaround" > Revert "io: add support for activating TLS thread safety workaround" > Revert "crypto: add tracing & warning about GNUTLS countermeasures" > Revert "crypto: implement workaround for GNUTLS thread safety > problems"
Acked-by: Peter Xu <[email protected]> -- Peter Xu
